CVE-2026-73683

Executive Summary

CVE-2026-73683 is an authentication bypass vulnerability in Laravel Socialite's Facebook OAuth provider. The flaw is caused by the absence of nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php, which allows an unauthenticated attacker to replay a captured OIDC id_token and obtain unauthorized access to victim accounts. Applications that accept Facebook id_token logins through the userFromToken() backend endpoint are affected, and successful exploitation enables full account takeover with high confidentiality, integrity, and availability impact.

Technical Analysis

The vulnerable component is the Facebook provider of Laravel Socialite, a popular third-party authentication package for PHP applications using Laravel. The NVD description identifies the core flaw as a missing nonce comparison during OpenID Connect (OIDC) id_token processing. The affected code path is getUserByOIDCToken() in FacebookProvider.php, which is responsible for taking an OIDC id_token supplied by the client and deriving the authenticated user identity.

In a standards-compliant OIDC flow, an id_token contains claims such as iss (issuer), aud (audience), exp (expiration), and nonce. The nonce claim is a session-bound random value generated by the relying party and included in the initial authorization request. When the id_token is returned, the relying party must verify that the nonce in the token matches the value stored in the user's session. This binds the token to the specific browser session and prevents capture-and-replay attacks.

According to the advisory data, getUserByOIDCToken() validates the token's signature, aud claim, and iss claim, but does not perform the required session-bound nonce comparison. Therefore, the function implicitly treats any valid, unexpired id_token issued for the target Facebook App ID as proof of a legitimate session. Since the signature and standard claims are verified, the token is cryptographically valid; the missing nonce check is the only failed validation step.

The attack surface is the public authentication endpoint that calls userFromToken(). This entry point accepts an OIDC id_token and, after verification via getUserByOIDCToken(), returns or creates the corresponding user account. Because the token is a bearer credential, the attacker only needs to possess a valid token to impersonate the legitimate user. The flaw is classified as CWE-294 — Authentication Bypass by Capture-replay. The CVSS vector indicates a network-based attack with high attack complexity because obtaining a valid victim token is nontrivial; however, once obtained, no user interaction or special privileges are required, and the impact to confidentiality, integrity, and availability is uniformly high.

No affected version range is published, and the OSV entry marks the package as 0→unfixed. The patch confidence is low (2/4), meaning only a single source has claimed a patch exists, and it has not been independently confirmed.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class and the technical description. No public exploit code or PoC has been reported.

1. Reconnaissance and token capture
   The attacker identifies a Laravel application using Socialite's Facebook provider and a backend userFromToken() endpoint. To proceed, the attacker must first obtain a valid, unexpired id_token issued for the same Facebook App ID used by the target application. Possible capture vectors include client-side cross-site scripting (XSS), malicious browser extensions, network interception on an insecure channel, or theft of tokens from logs or shared storage. The attacker's objective is to obtain a token belonging to a victim who has an account on the target application.

2. Triggering the vulnerability
   The attacker submits the captured token to the backend userFromToken() endpoint, impersonating the legitimate authentication client. Because getUserByOIDCToken() verifies the signature, aud, and iss claims, the token appears valid: it was genuinely issued by Facebook for the correct App ID and is not expired. The crucial missing step is the nonce comparison, which would normally tie the token to the original browser session. Without it, the server accepts the token as if it were being presented by the legitimate user in the same authenticated session.

3. Exploitation at the vulnerability-class level
   The payload is the token itself — an OIDC id_token serialized in JWT compact format (base64url-encoded header, payload, and signature). At the HTTP level, the attacker simply includes the token in the request to userFromToken(), either in a request body parameter, an authorization header, or a form field, depending on the application's implementation. The server-side handler forwards it to getUserByOIDCToken(), which returns the victim's user identity without performing the session nonce binding.

4. Post-exploitation impact
   After successful token replay, the application treats the attacker as the victim. This results in unauthorized access to the victim's account, including their profile data, associated data records, and any application functionality available to that account. If the affected account has administrative privileges, the impact expands to broader platform compromise, including data exfiltration, service disruption, and lateral movement within connected applications. Availability impact may occur if the attacker modifies or deletes victim data.

Impact Assessment

The CVSS v3.1 score of 8.1 reflects a serious authentication flaw with high impact across all three security objectives. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates:

• Attack Vector — Network: exploitation can be performed remotely.
• Attack Complexity — High: the attacker must obtain a valid, unexpired id_token, which requires an additional compromise step.
• Privileges Required — None: no prior authentication is needed to replay a captured token.
• User Interaction — None: the victim does not need to click a malicious link or perform any action during the attack.
• Impact — High on confidentiality, integrity, and availability: successful theft of one id_token leads to complete account takeover, unauthorized data access, data modification, and potential denial of service.

The business impact is significant for any organization using Laravel Socialite's Facebook provider. A single stolen id_token represents a direct account takeover risk. For consumer-facing applications, this can lead to identity theft, fraudulent transactions, reputational damage, and regulatory penalties. For enterprise applications, it could expose internal business data, customer records, or protected intellectual property. The lack of a publicly published affected version range complicates simple version-based triage; organizations must assess their own code path to determine whether they use getUserByOIDCToken() and userFromToken().

The EPSS score has not yet been published by FIRST.org. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no exploit code or public PoC has been confirmed at the time of this report.

Detection Guidance

The following detection rules are designed to identify suspicious authentication requests that may indicate exploitation of CVE-2026-73683. They should be tuned to the local environment and monitored for false positives, especially since id_token is a common parameter name in legitimate OIDC flows.

Sigma Rule

title: CVE-2026-73683 - Laravel Socialite Facebook OIDC Token Replay
id: 5c3b1a2e-7368-3c83-9a2b-4f1e6d7c9a01
status: experimental
description: Detects HTTP requests to the userFromToken endpoint containing an OIDC id_token, which may indicate replay of a captured token.
logsource:
  category: web
  product: generic
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains:
      - userFromToken
      - user_from_token
  filter_known_good:
    cs-uri-query|contains:
      - state=
      - nonce=
  condition: selection and not filter_known_good
falsepositives:
  - Legitimate OIDC callbacks that include state and nonce parameters
  - Custom applications with IDs containing 'userFromToken'
level: high

YARA Rule

rule CVE_2026_73683_Laravel_Socialite_Token_Replay
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects PHP source code or artifacts referencing the vulnerable Socialite Facebook provider code path"
        cve = "CVE-2026-73683"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "getUserByOIDCToken" ascii
        $b = "userFromToken" ascii
        $c = "FacebookProvider.php" ascii
        $d = "id_token" ascii
        $e = "nonce" ascii
    condition:
        uint16(0) == 0x5A4D or 1 of ($a, $b, $c)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-73683 - Laravel Socialite Facebook id_token replay attempt";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"userFromToken";
    http.request_body;
    content:"id_token";
    classtype:attempted-admin;
    reference:cve,2026-73683;
    sid:202673683;
    rev:1;
)

Elastic Detection

any where network.protocol == "http"
    and http.request.method == "POST"
    and url.path like "*userFromToken*"
    and request.body.text like "*id_token*"

Splunk SPL Query

index=web OR index=proxy
| where method="POST" AND (uri LIKE "%userFromToken%" OR form_data LIKE "%userFromToken%")
| search form_data="*id_token*" OR body="*id_token*"
| table _time, src_ip, dest_ip, uri, http_user_agent, status
| stats count by src_ip, uri, status

Wazuh OSSEC Rule

<group name="web,CVE-2026-73683,">
  <rule id="100283" level="12">
    <decodedata>userFromToken</decodedata>
    <regex>userFromToken.*id_token</regex>
    <description>CVE-2026-73683: Possible Laravel Socialite OIDC id_token replay detected</description>
    <group>authentication_failure,web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) claims a patch exists, but the claim is not independently confirmed. The OSV entry describes the package as 0→unfixed, and no vendor fix version is available. Administrators should not rely on an unverified patch claim and must apply compensating controls.

1. Immediate mitigations

   • Disable the Facebook OIDC login provider if it is not business-critical.
   • Enforce additional verification for accounts logging in via the Facebook provider, such as an email confirmation or step-up authentication challenge.
   • Monitor logs for repeated identical id_token values submitted to userFromToken() from different source IP addresses or user agents; replay attempts will produce multiple sessions for the same token.
   • Rotate credentials and revoke sessions for any user accounts suspected of being affected by token replay.

2. Patch and upgrade steps

   • Confirm with the application owner whether the installed Laravel Socialite package is affected.
   • Check for an updated release of Laravel Socialite that restores OIDC nonce validation in getUserByOIDCToken().
   • Apply the vendor patch as soon as a verified fixed version is published. Until then, treat the package as unfixed.
   • Re-test the Facebook login flow after upgrading to ensure nonce is generated per session and validated upon token receipt.

3. Long-term hardening

   • Move to a standard OIDC library where nonce validation is enforced by default rather than relying on custom provider logic.
   • Reduce id_token exposure by ensuring all OAuth/OIDC traffic is transported over TLS.
   • Perform code review of all social login providers to verify that session-bound claims (nonce, state) are validated.
   • Implement short id_token lifetimes and integrate with backend session revocation so that a captured token has a shorter useful window.
   • Add anomaly detection rules that flag the same OIDC id_token being used in multiple distinct sessions.

References

• NVD — CVE-2026-73683 details: https://nvd.nist.gov/vuln/detail/CVE-2026-73683
• OSV vulnerability record for CVE-2026-73683: https://osv.dev/vulnerability/CVE-2026-73683
• CWE-294 — Authentication Bypass by Capture-replay: https://cwe.mitre.org/data/definitions/294.html
• FIRST.org EPSS calculator (not yet scored for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-73683 at the time of writing.