External risk intelligence

Laravel Socialite Facebook Provider Authentication Bypass via Replayed OIDC ID Tokens.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-73683

The vulnerability affects a library used for integrating OAuth/OIDC authentication providers in web applications. These implementations are by design public-facing, as they handle user login flows directly via internet-accessible endpoints and external identity services.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security issue in Laravel Socialite's Facebook provider could allow unauthorized access to user accounts by replaying captured authentication tokens. This vulnerability affects the process of verifying identity through Facebook logins and may lead to bypassing existing security controls.

Authentication bypass using replayed tokens.
Matters for protecting user account access.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

Attackers can bypass authentication by replaying captured OIDC id_tokens, allowing them to access victim accounts. This is possible because the Facebook provider in Laravel Socialite fails to validate the nonce claim in tokens issued by Facebook. An attacker who obtains a valid, unexpired id_token for the same Facebook App ID can submit it to the backend, circumventing security checks.

Requires no initial authentication.
Replays captured OIDC id_tokens.
Grants unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authentication and gain unauthorized access to user accounts. When supported by the advisory, this could occur if an attacker obtains a valid, unexpired OIDC id_token for the affected Facebook App ID and submits it to the backend userFromToken() endpoint. The missing nonce validation allows the token to be replayed, leading to unauthorized account access.

User account access.
Replaying captured OIDC id_tokens.
Unauthorized access to victim accounts.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner and platform team are most likely responsible for addressing this authentication bypass vulnerability. The first practical step involves identifying all instances of the affected technology, confirming their reachability and business criticality, and then assigning an accountable owner to plan remediation based on the assessed risk.

Identify affected applications and their owners.
Verify external reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Laravel Socialite and why is it used?

Laravel Socialite is a PHP library for the Laravel framework that simplifies integrating third-party authentication services, such as Facebook, Google, or GitHub. Developers use it to allow users to sign into web applications using their existing social media accounts, streamlining the login experience while managing the complex OAuth and OpenID Connect protocols behind the scenes.

What does CWE-294 mean in the context of CVE-2026-73683?

CWE-294 refers to Authentication Bypass by Capture-replay. In this specific CVE, the Laravel Socialite Facebook provider fails to verify the 'nonce' claim—a unique, one-time value meant to bind an identity token to a specific login attempt. Because this check is missing, an attacker who intercepts a valid, unexpired token can resubmit it to the application to trick the system into logging them in as another user, effectively bypassing authentication.

How can an attacker trigger this authentication bypass?

An attacker needs to capture a valid, unexpired OIDC identity token originally issued by Facebook for the target application's App ID. They then replay this token by submitting it to the application's userFromToken() backend endpoint. Simply possessing a token for a different app or an expired token will not trigger the vulnerability, as other security checks like signature validation and audience matching still function correctly.

Is my application at risk for CVE-2026-73683?

If your application uses Laravel Socialite with the Facebook provider, it is potentially affected. According to Halo Surface Signal, this vulnerability is particularly relevant because social login implementations are designed to be public-facing to interact with external identity providers. Applications that rely on these endpoints for user access are considered high-priority for review.

What steps should I take to address this vulnerability?

Begin by auditing your codebase to identify all locations where Laravel Socialite is utilized for Facebook authentication. Determine which applications are internet-facing and critical to your business operations. Once identified, assign a lead to evaluate the risk and prepare to update the library or implement the necessary nonce validation logic to ensure that tokens cannot be reused maliciously.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.