Laravel Socialite CVE-2026-73683

Exploitation requires that the target application uses the Facebook provider's Limited Login / OIDC token path (FacebookProvider::userFromToken() → getUserByOIDCToken()) on a Socialite version before 5.29.0, and that the attacker possesses a valid, unexpired Facebook id_token minted for the same Facebook App ID as the target. No authentication and no victim interaction are needed (PR:N/UI:N), so any party who can present such a token to the endpoint succeeds. The limiting factors are: the token must be unexpired and issued for the identical App ID, the app must expose the OIDC/id_token login flow (apps using only the server-side authorization-code exchange are not exposed to this specific replay), and the attacker must first acquire the token out-of-band (reflected in CVSS AC:H) since it cannot be forged.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.2) captures both the severity and the one real friction point: PR:N/UI:N means no authentication and no victim interaction, but AC:H reflects that the attacker must first obtain a valid, unexpired id_token issued for the same Facebook App ID - the token is not attacker-generatable, so this is a replay/capture attack rather than a token-forgery attack. That elevates it from theoretical to serious wherever id_tokens can leak (referer headers, logs, proxies, malicious client-side script, or a shared/hostile client). There is no EPSS score, KEV entry, or public POC in the provided data, so real-world exploitation should be treated as plausible-but-unproven rather than active. The signals are internally consistent: a genuinely high-impact account-takeover flaw whose exploitation is gated by token acquisition, not by any server-side defense, so it warrants prompt patching for any app using the Facebook Limited Login / OIDC token path.

An attacker captures a victim's valid, unexpired Facebook id_token - for example from a malicious or compromised client, a leaked log, or an intercepted request - that was issued for the target application's Facebook App ID. The attacker POSTs that token to the application's userFromToken()/OIDC login endpoint; because signature, aud, and iss pass and no nonce is checked, the server establishes an authenticated session as the victim. No public POC is identified, and the practical hurdle is obtaining the token (CVSS AC:H).