Laravel Socialite’s Facebook provider fails to validate the nonce claim when processing OIDC id_tokens. The missing check allows an attacker to capture a valid, unexpired token issued for a target Facebook App ID and replay it to the backend userFromToken endpoint. Because the signature, audience, and issuer checks pass but no session‑bound nonce comparison occurs, the returned token authenticates the attacker as the victim, yielding unauthorized access to the victim’s account.

The vulnerability affects the Laravel Socialite package, specifically the FacebookProvider implementation used within Laravel applications. No explicit affected version range is supplied, so all installations prior to the fix commit should be considered vulnerable.

The CVSS score of 9.2 indicates a critical severity, and the vulnerability is not currently listed in the CISA KEV catalog. The EPSS score is unavailable, but the high CVSS together with the nature of the flaw means the exploit is feasible through a web request to the userFromToken endpoint once a valid id_token is captured. Attackers can obtain such a token via normal social login flows or by compromising the Facebook App used by the target application. Remote attackers can replay the token over the network, bypassing authentication controls and gaining the victim’s privileges.