Executive brief
Laravel Socialite is a widely-used PHP library that simplifies social authentication for Laravel applications by handling OAuth handshakes with platforms like Facebook. A missing validation check in the Facebook provider allows attackers who obtain a valid Facebook ID token to replay it against applications, gaining unauthorized access to user accounts without needing to perform the full authentication flow. An attacker could impersonate any user whose ID token they capture, potentially accessing sensitive data and performing actions on their behalf.
Technical details
This vulnerability is a OIDC token replay attack in the FacebookProvider class. The root cause is the absence of nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Although the code correctly verifies the token's signature, audience (aud), and issuer (iss), it fails to validate the nonce claim, which is a session-bound value designed to prevent replay attacks. An unauthenticated attacker who obtains a valid, unexpired id_token issued for the same Facebook App ID can submit this token to the backend userFromToken() endpoint, and the missing nonce check allows the application to accept and use the replayed token. The attack requires network access to the application endpoint and prior knowledge or capture of a legitimate id_token, but no other preconditions. A patch has been released that adds nonce validation to prevent token reuse.
Affected products
- Laravel Socialite before patched version (patch committed 2026-08-14)
Timeline
- 2026-08-14: disclosed
- 2026-08-14: patched: Fix released via commit caf714f55d51ab0d914b40033d8b0f489d6219cc adding nonce validation