Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Laravel Socialite Facebook Login Bypass by Stolen Token

CVE-2026-73683 · published 1 day ago
Summary

Attackers can use a stolen Facebook login token to access accounts without a password. This happens because Laravel Socialite doesn't check if the token has been used before. To protect your users, update Laravel Socialite to the latest version, and make sure you're using a secure connection (HTTPS) to prevent token interception.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software
VendorProductAffected versions
laravel socialite < 5.29.0
Original advisory text
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim v...
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.
References
Severity
9.2 Critical
CVSS 3.1: 8.1 (MITRE)
Exploitation
EPSS <1%
Type
CWE-294
Timeline
Published14 Aug 2026
Updated15 Aug 2026
First seen14 Aug 2026
Sources
CVE-2026-73683 · NVD
CVE-2026-73683 · MITRE
Monitor software like this
Free during beta