An authentication bypass vulnerability in Laravel Socialite's Facebook provider allows unauthenticated attackers to hijack user sessions via replayed OIDC tokens.

This vulnerability involves an authentication bypass caused by a failure to validate the nonce claim in OIDC id_tokens within the FacebookProvider. An unauthenticated attacker can capture a legitimate token and replay it to masquerade as a valid user.

Successful exploitation allows unauthorized access to user accounts, potentially leading to full account takeover and exposure of sensitive user data. Given the CVSS score of 8.1, this is a high-severity flaw that compromises the integrity of the authentication process, which is a foundational security control for applications utilizing social login.

Immediate Action: Upgrade Laravel Socialite to version 5.29.0 or later to ensure proper nonce validation is implemented.

Proactive Monitoring: Review authentication logs for anomalous login patterns, specifically multiple successful logins using the same token identifier within a short timeframe.

Compensating Controls: If immediate patching is not feasible, implement strict rate limiting on authentication endpoints to hinder automated replay attempts.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to user account integrity. Administrators must prioritize updating the Laravel Socialite package to version 5.29.0 immediately to remediate the missing nonce validation and prevent session replay attacks.