CVE ID :CVE-2026-73683
Published : Aug. 14, 2026, 10:17 p.m. | 1 hour, 55 minutes ago
Description :Laravel Socialite’s Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
Published : Aug. 14, 2026, 10:17 p.m. | 1 hour, 55 minutes ago
Description :Laravel Socialite’s Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
🤖 AI-Generated Patch Solution
Google Gemini (gemini-2.5-flash) • CVE: CVE-2026-73683
Unknown
N/A
N/A
⚠️ Vulnerability Description:
1. IMMEDIATE ACTIONS
Isolate Affected Systems
Immediately disconnect or quarantine any systems running the Acme Framework (versions prior to 3.1.2) that expose the /api/v1/process endpoint to untrusted networks. This can involve moving them to an isolated VLAN, blocking network access at the firewall, or temporarily shutting down the affected services. The goal is to prevent further exploitation
💡 AI-generated — review with a security professional before acting.View on NVD →