Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-15 | 1 | General1 |
| 2026-08-16 | 2 | General1Patch1 |
僕の後輩らしい🫣（ほんと） CVE取れたので脆弱性の説明と学習したこと リプレイ攻撃の脆弱性 - CVE-2026-73683 -｜meihao550 https://zenn.dev/meihao550/articles/a1561a73696d77 #zenn
Post summary
The post notes that a junior colleague found CVE-2026-73683, a replay‑attack vulnerability, and provided a link to an article explaining it, but offers no details on exploits, patches, or active exploitation.
CVE取れたので脆弱性の説明と学習したこと リプレイ攻撃の脆弱性 - CVE-2026-73683 -｜meihao550 https://zenn.dev/meihao550/articles/a1561a73696d77 #zenn
Post summary
The author announces having CID CVE-2026‑73683 and notes it is a replay attack vulnerability, citing an explanatory article where they share their findings and learning.
#CVE-2026-73683: #Laravel Socialite < 5.29.0 OIDC token replay. Valid signature/issuer. > No nonce validation. Capture a victim Facebook "id_token", replay it against the same App ID, get the victim identity back , "et voilà !" Just missing transaction binding (no jwt forgery). Fix: "hash_equals($expectedNonce, $data['nonce'])" Technical details / patch : https://github.com/laravel/socialite/pull/789?utm_source=chatgpt.com
Post summary
Laravel Socialite <5.29.0 suffers from OIDC token replay due to missing nonce validation; the issue is mitigated by adding a nonce check and a pull request patch is available.