{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/socialite/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-73683"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Socialite"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Laravel"],"content_html":"\u003cp\u003eLaravel Socialite's Facebook provider contains an authentication bypass vulnerability, identified as CVE-2026-73683, stemming from a lack of nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. OpenID Connect (OIDC) relies on the nonce claim to bind an ID token to a specific client session, preventing replay attacks. Because the implementation fails to perform this comparison, an attacker who obtains a valid, unexpired id_token issued for the same Facebook App ID can submit the token to the application's userFromToken() endpoint. The application performs successful signature, audience, and issuer validation but fails to verify session-bound uniqueness, allowing the attacker to masquerade as the legitimate user. This flaw significantly impacts services relying on Laravel Socialite for OAuth and OIDC authentication, potentially leading to widespread account takeover.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker monitors network traffic or intercepts OIDC id_tokens issued for a target Facebook App ID.\u003c/li\u003e\n\u003cli\u003eAttacker successfully captures a valid, unexpired id_token intended for a victim session.\u003c/li\u003e\n\u003cli\u003eAttacker identifies the target application's userFromToken() OIDC callback endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP request to the target endpoint, inserting the captured id_token into the token parameter.\u003c/li\u003e\n\u003cli\u003eThe Laravel Socialite FacebookProvider backend receives the request and executes getUserByOIDCToken().\u003c/li\u003e\n\u003cli\u003eThe backend performs standard cryptographic validation (signature, iss, aud), which succeeds.\u003c/li\u003e\n\u003cli\u003eThe backend neglects to perform nonce validation, treats the replayed token as a legitimate new authentication request.\u003c/li\u003e\n\u003cli\u003eThe application establishes a session for the attacker, granting access to the victim's account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to hijack user sessions without requiring victim credentials or interaction. This vulnerability affects any application utilizing the Laravel Socialite Facebook provider, creating a high risk of unauthorized access, sensitive data exposure, and account takeover across impacted sectors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately audit applications using Laravel Socialite to determine if the Facebook provider is active and if the environment is susceptible to OIDC token replay.\u003c/li\u003e\n\u003cli\u003eApply vendor-provided patches or update Laravel Socialite to a version that enforces nonce validation in FacebookProvider.php as indicated by CVE-2026-73683.\u003c/li\u003e\n\u003cli\u003eImplement additional server-side session controls and log monitoring for the userFromToken() endpoint to identify spikes in token submission originating from unexpected sources or mismatched session parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-15T00:14:41Z","date_published":"2026-08-15T00:14:41Z","id":"https://feed.craftedsignal.io/briefs/2026-08-laravel-socialite-auth-bypass/","summary":"An authentication bypass vulnerability in Laravel Socialite's Facebook provider allows attackers to replay valid OIDC tokens due to missing nonce validation.","title":"Authentication Bypass in Laravel Socialite Facebook Provider","url":"https://feed.craftedsignal.io/briefs/2026-08-laravel-socialite-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Socialite","version":"https://jsonfeed.org/version/1.1"}