# CVE-2026-73683: Laravel Socialite authentication bypass in Facebook provider

Source: https://junglewise.ai/threats/cve-2026-73683-laravel-socialite-authentication-bypass-in-facebook-provider  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73683 · Severity: high · CVSS 8.1 · Published 2026-08-14

Laravel Socialite is a widely-used PHP library that simplifies social authentication for Laravel applications by handling OAuth handshakes with platforms like Facebook. A missing validation check in the Facebook provider allows attackers who obtain a valid Facebook ID token to replay it against applications, gaining unauthorized access to user accounts without needing to perform the full authentication flow. An attacker could impersonate any user whose ID token they capture, potentially accessing sensitive data and performing actions on their behalf.

Vendors: [Laravel](https://junglewise.ai/threats/vendors/laravel).

## Quick answers

**Is CVE-2026-73683 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73683 being exploited in the wild.

**How severe is CVE-2026-73683?** High severity, with a CVSS score of 8.1, published 14 August 2026.

**Which products and versions are affected?** Laravel Socialite before patched version (patch committed 2026-08-14).

**Is there a fix for CVE-2026-73683?** A patch was published on 2026-08-14: Fix released via commit caf714f55d51ab0d914b40033d8b0f489d6219cc adding nonce validation Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73683 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-73683?** Check whether you run Laravel Socialite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a OIDC token replay attack in the FacebookProvider class. The root cause is the absence of nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Although the code correctly verifies the token's signature, audience (aud), and issuer (iss), it fails to validate the nonce claim, which is a session-bound value designed to prevent replay attacks. An unauthenticated attacker who obtains a valid, unexpired id_token issued for the same Facebook App ID can submit this token to the backend userFromToken() endpoint, and the missing nonce check allows the application to accept and use the replayed token. The attack requires network access to the application endpoint and prior knowledge or capture of a legitimate id_token, but no other preconditions. A patch has been released that adds nonce validation to prevent token reuse.

## Affected products

- Laravel Socialite before patched version (patch committed 2026-08-14)

## Timeline

- 2026-08-14: disclosed
- 2026-08-14: patched: Fix released via commit caf714f55d51ab0d914b40033d8b0f489d6219cc adding nonce validation

## References

- [https://github.com/laravel/socialite](https://github.com/laravel/socialite)
- [https://github.com/laravel/socialite/commit/caf714f55d51ab0d914b40033d8b0f489d6219cc](https://github.com/laravel/socialite/commit/caf714f55d51ab0d914b40033d8b0f489d6219cc)