EUVD-2026-58810
GHSA-cr46-5p72-vh72
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N and PR:N/UI:N since a captured token replays with no auth or interaction, AC:H because the attacker must first obtain a valid unexpired token for the same App ID; account takeover gives C:H/I:H while availability is not directly impacted.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.
Articles & Coverage 1
AnalysisAI
Authentication bypass in Laravel Socialite's Facebook provider (versions before 5.29.0) lets unauthenticated remote attackers replay captured OIDC id_tokens because getUserByOIDCToken() in FacebookProvider.php validates signature, aud, and iss but never checks a session-bound nonce. An attacker holding any valid, unexpired id_token minted for the same Facebook App ID can submit it to the backend's userFromToken() endpoint and be logged in as the victim, achieving full account takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses the Facebook provider's Limited Login / OIDC token path (FacebookProvider::userFromToken() → getUserByOIDCToken()) on a Socialite version before 5.29.0, and that the attacker possesses a valid, unexpired Facebook id_token minted for the same Facebook App ID as the target. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.2) captures both the severity and the one real friction point: PR:N/UI:N means no authentication and no victim interaction, but AC:H reflects that the attacker must first obtain a valid, unexpired id_token issued for the same Facebook App ID - the token is not attacker-generatable, so this is a replay/capture attack rather than a token-forgery attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker captures a victim's valid, unexpired Facebook id_token - for example from a malicious or compromised client, a leaked log, or an intercepted request - that was issued for the target application's Facebook App ID. The attacker POSTs that token to the application's userFromToken()/OIDC login endpoint; because signature, aud, and iss pass and no nonce is checked, the server establishes an authenticated session as the victim. … |
| Remediation | Vendor-released patch: upgrade Laravel Socialite to 5.29.0 or later (composer require laravel/socialite:^5.29 / composer update laravel/socialite), which is the primary and complete fix - see PR https://github.com/laravel/socialite/pull/789 and commit https://github.com/laravel/socialite/commit/caf714f55d51ab0d914b40033d8b0f489d6219cc. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all applications using Laravel Socialite versions prior to 5.29.0 with Facebook OAuth enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today