CVE-2026-73683

CVE-2026-73683 describes an authentication bypass vulnerability found in the Facebook provider of Laravel Socialite. This flaw allows unauthenticated attackers to replay captured OpenID Connect (OIDC) `id_tokens`. The vulnerability stems from a missing nonce claim validation within the `getUserByOIDCToken()` function in `FacebookProvider.php`. Attackers who obtain a valid, unexpired `id_token` issued for the same Facebook App ID can submit this token to the backend `userFromToken()` endpoint. This bypasses authentication controls because signature, audience (`aud`), and issuer (`iss`) checks pass, while no session-bound nonce comparison is performed, ultimately leading to unauthorized access to victim accounts.