The vulnerability in Laravel Socialite's Facebook provider arises from the absence of nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid and unexpired OpenID Connect (OIDC) id_token issued for the same Facebook App ID can replay this token by submitting it to the backend userFromToken() endpoint. Because signature, audience (aud), and issuer (iss) checks are performed but no session-bound nonce comparison is done, the authentication controls can be bypassed, leading to unauthorized access to user accounts.

Successful exploitation allows unauthenticated attackers to bypass authentication and gain unauthorized access to victim accounts by replaying captured valid id_tokens. This compromises confidentiality, integrity, and availability of affected user accounts as indicated by the CVSS score of 8.1 with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, applications using Laravel Socialite's Facebook provider should consider implementing additional nonce validation checks or other compensating controls to prevent token replay attacks.