The vulnerability exists in the getUserByOIDCToken() function within FacebookProvider.php of Laravel Socialite. The function fails to validate the nonce claim in the OIDC id_token, enabling attackers who have captured a valid token to replay it. Although signature, audience (aud), and issuer (iss) checks are performed and pass, the absence of session-bound nonce comparison allows attackers to bypass authentication and gain unauthorized access by submitting the captured token to the backend userFromToken() endpoint.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain unauthorized access to victim accounts associated with the same Facebook App ID. This can lead to full compromise of user accounts, impacting confidentiality, integrity, and availability of affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been documented at this time. Until a patch is available, consider implementing additional nonce validation or token replay protections at the application level if feasible.