Read the docs
TI-2026-51760 Aliases CVE-2026-73683GHSA-cr46-5p72-vh72

Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay

Priority MEDIUM 43CWE-294Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-294.

Summary

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0076 55th percentileScored 2026-11-07
Fix Fixed Socialite (Laravel): 5.29.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LaravelSocialitebefore 5.29.05.29.0Patch availableCNA
  • Socialite VendorLaravel Affected before 5.29.0 Fixed in 5.29.0 Patch available CNA

Remediation

  • Fix · CNA Socialite (Laravel) Fixed in 5.29.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-73683
  2. 2026-10-03 Alias added: GHSA-cr46-5p72-vh72

References

Patch 2

Advisory 1

  • TI-2021-02221 Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-33912 Livewire vulnerable to remote command execution during property update hydration KEVCVSS 4.0CRITICAL 9.2
  • TI-2018-10827 In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might… KEVCVSS 3.1HIGH 8.1
  • TI-2021-09454 A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows… CVSS 3.1CRITICAL 9.8
  • TI-2022-02662 laravel deserialization CVSS 3.1CRITICAL 9.8
  • TI-2017-12436 In Laravel framework through 5.5.21, remote attackers can obtain sensitive information… CVSS 3.0HIGH 7.5
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences