Description

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-14T22:17:11.550Z",
  "pubdate": "2026-08-14T22:17:11.550Z",
  "executiveSummary": "An authentication bypass vulnerability exists in Laravel Socialite's Facebook provider, specifically within the OIDC authentication handling logic.\nThe vulnerability allows unauthenticated remote attackers to achieve unauthorized access to victim accounts by replaying captured OpenID Connect (OIDC) id_tokens.\nThe affected product is Laravel Socialite, impacting the Facebook provider implementation.\nThe root cause stems from missing nonce claim validation during the token processing phase in the affected function.\nAn attacker who obtains a valid, unexpired id_token issued for the same Facebook App ID can successfully bypass authentication controls.\nThe risk implication is critical, as successful exploitation leads to complete account takeover and unauthorized access to user accounts without requiring user credentials or interaction beyond obtaining a valid token.\nExploitation requires the attacker to capture a legitimate id_token and submit it to the vulnerable backend endpoint while the token remains unexpired.",
  "technicalDetails": "The vulnerability resides in the FacebookProvider.php component of Laravel Socialite, specifically within the getUserByOIDCToken() function.\nWhen processing authentication via OIDC id_tokens, the application validates cryptographic signatures, the audience claim (aud), and the issuer claim (iss). However, the implementation fails to perform session-bound nonce comparison.\nThe absence of nonce validation allows an attacker to capture a valid id_token issued during a legitimate authentication flow and replay it in a separate session or request context.\nThe attack flow proceeds as follows: 1) An attacker intercepts a valid, unexpired id_token issued for the target Facebook App ID. 2) The attacker submits the captured id_token to the backend userFromToken() endpoint. 3) The backend processes the token, successfully validating the signature, aud, and iss claims. 4) Due to the lack of nonce claim validation, the missing check fails to detect that the token was generated for a different or prior authentication context. 5) The backend authenticates the request, granting the attacker unauthorized access to the victim account associated with the token.\nThe vulnerability requires no prior authentication or special privileges, operating via network exposure against the application's authentication endpoints.\nPost-exploitation impact includes full account compromise, unauthorized data access, and potential persistence depending on application-level session generation following the Socialite authentication callback."
}