CVE-2026-73683 Laravel CVE debrief

Who should care

Defenders responsible for Laravel Socialite Facebook provider implementations should assess exposure and prioritize verification and updates to prevent authentication bypass via nonce replay attacks.

Why it matters

Defenders should prioritize verifying and updating Laravel Socialite Facebook provider implementations to prevent authentication bypass via nonce replay attacks, as this vulnerability allows unauthenticated attackers to bypass authentication controls and potentially access victim accounts.

• Potential unauthorized access to victim accounts via replayed OIDC id_tokens
• Bypass of authentication controls due to missing nonce claim validation
• Possible exploitation by unauthenticated attackers who obtain valid, unexpired id_tokens

Technical summary

The Laravel Socialite Facebook provider contains an authentication bypass vulnerability due to missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. This allows unauthenticated attackers to replay captured OIDC id_tokens and bypass authentication controls. The vulnerability arises because the getUserByOIDCToken() function does not perform a session-bound nonce comparison, despite passing signature, aud, and iss checks. As a result, attackers with a valid, unexpired id_token issued for the same Facebook App ID can bypass authentication controls, potentially leading to unauthorized access to victim accounts. To mitigate this vulnerability, defenders should prioritize

Defensive priority

Defenders should prioritize verifying and updating Laravel Socialite Facebook provider implementations to prevent authentication bypass via nonce replay attacks.

Recommended defensive actions

• Verify and update Laravel Socialite Facebook provider implementations to prevent authentication bypass via nonce replay attacks
• Implement proper nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php
• Review and update authentication controls to prevent unauthorized access to victim accounts
• Conduct thorough reviews of current authentication mechanisms to ensure they are not vulnerable to similar attacks
• Update relevant documentation and training materials to reflect the importance of nonce claim validation
• Perform regular security audits to identify and address potential vulnerabilities in the Laravel Socialite Facebook provider
• Engage with the Laravel community or hire a security expert to perform a code review of the Facebook provider implementation

Evidence notes

The CVE record and NVD entry provide details on the authentication bypass vulnerability in Laravel Socialite's Facebook provider, including the missing nonce claim validation in the getUserByOIDCToken() function.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.