[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-73683":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-15T04:37:00.429Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":527,"aliases":528,"duplicate_of":9,"upstream":529,"downstream":530,"duplicates":531,"related":532,"reserved_at":9,"published_at":533,"modified_at":533,"state":534,"summary":535,"references_raw":542,"kevs":564,"epss":9,"epss_history":565,"metrics":566,"affected":580},"CVE-2026-73683","Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-294","Authentication Bypass by Capture-replay","A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).","weakness","Incomplete","Base","High",[20,24,125,209,239,370,405,440,492,496],{"id":21,"name":22,"techniques":23},"CAPEC-102","Session Sidejacking",[],{"id":25,"name":26,"techniques":27},"CAPEC-509","Kerberoasting",[28],{"id":29,"name":26,"tactics":30,"countermeasures":34},"T1558.003",[31],{"id":32,"name":33},"TA0031","Credential Access",[35,40,45,49,54,59,63,68,72,76,80,84,88,92,96,101,105,109,113,117,121],{"id":36,"name":37,"tactic":38},"D3-CCSA","Credential Compromise Scope Analysis",{"name":39},"Detect",{"id":41,"name":42,"tactic":43},"D3-CR","Credential Revocation",{"name":44},"Evict",{"id":46,"name":47,"tactic":48},"D3-ANCI","Authentication Cache Invalidation",{"name":44},{"id":50,"name":51,"tactic":52},"D3-DUC","Decoy User Credential",{"name":53},"Deceive",{"id":55,"name":56,"tactic":57},"D3-NTF","Network Traffic Filtering",{"name":58},"Isolate",{"id":60,"name":61,"tactic":62},"D3-RTA","RPC Traffic Analysis",{"name":39},{"id":64,"name":65,"tactic":66},"D3-TBA","Token-based Authentication",{"name":67},"Harden",{"id":69,"name":70,"tactic":71},"D3-UGLPA","User Geolocation Logon Pattern Analysis",{"name":39},{"id":73,"name":74,"tactic":75},"D3-PMAD","Protocol Metadata Anomaly Detection",{"name":39},{"id":77,"name":78,"tactic":79},"D3-CSPP","Client-server Payload Profiling",{"name":39},{"id":81,"name":82,"tactic":83},"D3-PHDURA","Per Host Download-Upload Ratio Analysis",{"name":39},{"id":85,"name":86,"tactic":87},"D3-NTSA","Network Traffic Signature Analysis",{"name":39},{"id":89,"name":90,"tactic":91},"D3-APCA","Application Protocol Command Analysis",{"name":39},{"id":93,"name":94,"tactic":95},"D3-CH","Credential Hardening",{"name":67},{"id":97,"name":98,"tactic":99},"D3-RIC","Reissue Credential",{"name":100},"Restore",{"id":102,"name":103,"tactic":104},"D3-NTCD","Network Traffic Community Deviation",{"name":39},{"id":106,"name":107,"tactic":108},"D3-RTSD","Remote Terminal Session Detection",{"name":39},{"id":110,"name":111,"tactic":112},"D3-MFA","Multi-factor Authentication",{"name":67},{"id":114,"name":115,"tactic":116},"D3-CTS","Credential Transmission Scoping",{"name":58},{"id":118,"name":119,"tactic":120},"D3-CRO","Credential Rotation",{"name":67},{"id":122,"name":123,"tactic":124},"D3-TB","Token Binding",{"name":67},{"id":126,"name":127,"techniques":128},"CAPEC-555","Remote Services with Stolen Credentials",[129,163,196],{"id":130,"name":131,"tactics":132,"countermeasures":136},"T1021","Remote Services",[133],{"id":134,"name":135},"TA0109","Lateral Movement",[137,139,141,143,145,147,149,151,155,157,159],{"id":69,"name":70,"tactic":138},{"name":39},{"id":89,"name":90,"tactic":140},{"name":39},{"id":102,"name":103,"tactic":142},{"name":39},{"id":73,"name":74,"tactic":144},{"name":39},{"id":106,"name":107,"tactic":146},{"name":39},{"id":77,"name":78,"tactic":148},{"name":39},{"id":55,"name":56,"tactic":150},{"name":58},{"id":152,"name":153,"tactic":154},"D3-CAA","Connection Attempt Analysis",{"name":39},{"id":81,"name":82,"tactic":156},{"name":39},{"id":85,"name":86,"tactic":158},{"name":39},{"id":160,"name":161,"tactic":162},"D3-ST","Session Termination",{"name":44},{"id":164,"name":165,"tactics":166,"countermeasures":170},"T1114.002","Remote Email Collection",[167],{"id":168,"name":169},"TA0100","Collection",[171,175,180,184,188,192],{"id":172,"name":173,"tactic":174},"D3-EHB","Endpoint Health Beacon",{"name":39},{"id":176,"name":177,"tactic":178},"D3-LLM","Logical Link Mapping",{"name":179},"Model",{"id":181,"name":182,"tactic":183},"D3-NNI","Network Node Inventory",{"name":179},{"id":185,"name":186,"tactic":187},"D3-PLM","Physical Link Mapping",{"name":179},{"id":189,"name":190,"tactic":191},"D3-ER","Email Removal",{"name":44},{"id":193,"name":194,"tactic":195},"D3-RNA","Restore Network Access",{"name":100},{"id":197,"name":198,"tactics":199,"countermeasures":206},"T1133","External Remote Services",[200,203],{"id":201,"name":202},"TA0110","Persistence",{"id":204,"name":205},"TA0108","Initial Access",[207],{"id":160,"name":161,"tactic":208},{"name":44},{"id":210,"name":211,"techniques":212},"CAPEC-561","Windows Admin Shares with Stolen Credentials",[213],{"id":214,"name":215,"tactics":216,"countermeasures":218},"T1021.002","SMB/Windows Admin Shares",[217],{"id":134,"name":135},[219,221,223,225,227,229,231,233,235,237],{"id":81,"name":82,"tactic":220},{"name":39},{"id":69,"name":70,"tactic":222},{"name":39},{"id":102,"name":103,"tactic":224},{"name":39},{"id":77,"name":78,"tactic":226},{"name":39},{"id":85,"name":86,"tactic":228},{"name":39},{"id":106,"name":107,"tactic":230},{"name":39},{"id":152,"name":153,"tactic":232},{"name":39},{"id":73,"name":74,"tactic":234},{"name":39},{"id":89,"name":90,"tactic":236},{"name":39},{"id":55,"name":56,"tactic":238},{"name":58},{"id":240,"name":241,"techniques":242},"CAPEC-60","Reusing Session IDs (aka Session Replay)",[243,279],{"id":244,"name":245,"tactics":246,"countermeasures":256},"T1134.001","Token Impersonation/Theft",[247,250,253],{"id":248,"name":249},"TA0030","Defense Evasion",{"id":251,"name":252},"TA0005","Stealth",{"id":254,"name":255},"TA0111","Privilege Escalation",[257,259,261,263,265,267,269,271,273,275,277],{"id":110,"name":111,"tactic":258},{"name":67},{"id":50,"name":51,"tactic":260},{"name":53},{"id":97,"name":98,"tactic":262},{"name":100},{"id":114,"name":115,"tactic":264},{"name":58},{"id":122,"name":123,"tactic":266},{"name":67},{"id":41,"name":42,"tactic":268},{"name":44},{"id":46,"name":47,"tactic":270},{"name":44},{"id":93,"name":94,"tactic":272},{"name":67},{"id":64,"name":65,"tactic":274},{"name":67},{"id":118,"name":119,"tactic":276},{"name":67},{"id":36,"name":37,"tactic":278},{"name":39},{"id":280,"name":281,"tactics":282,"countermeasures":285},"T1550.004","Web Session Cookie",[283,284],{"id":248,"name":249},{"id":134,"name":135},[286,290,294,296,298,302,304,306,308,310,312,314,318,322,326,330,334,336,340,342,346,348,350,354,356,358,360,362,364,368],{"id":287,"name":288,"tactic":289},"D3-HBPI","Hardware-based Process Isolation",{"name":58},{"id":291,"name":292,"tactic":293},"D3-PLA","Process Lineage Analysis",{"name":39},{"id":41,"name":42,"tactic":295},{"name":44},{"id":77,"name":78,"tactic":297},{"name":39},{"id":299,"name":300,"tactic":301},"D3-HR","Host Reboot",{"name":44},{"id":85,"name":86,"tactic":303},{"name":39},{"id":69,"name":70,"tactic":305},{"name":39},{"id":89,"name":90,"tactic":307},{"name":39},{"id":36,"name":37,"tactic":309},{"name":39},{"id":102,"name":103,"tactic":311},{"name":39},{"id":118,"name":119,"tactic":313},{"name":67},{"id":315,"name":316,"tactic":317},"D3-PS","Process Suspension",{"name":44},{"id":319,"name":320,"tactic":321},"D3-KBPI","Kernel-based Process Isolation",{"name":58},{"id":323,"name":324,"tactic":325},"D3-SCF","System Call Filtering",{"name":58},{"id":327,"name":328,"tactic":329},"D3-PT","Process Termination",{"name":44},{"id":331,"name":332,"tactic":333},"D3-HS","Host Shutdown",{"name":44},{"id":81,"name":82,"tactic":335},{"name":39},{"id":337,"name":338,"tactic":339},"D3-PSMD","Process Self-Modification Detection",{"name":39},{"id":50,"name":51,"tactic":341},{"name":53},{"id":343,"name":344,"tactic":345},"D3-WSAM","Web Session Access Mediation",{"name":58},{"id":73,"name":74,"tactic":347},{"name":39},{"id":93,"name":94,"tactic":349},{"name":67},{"id":351,"name":352,"tactic":353},"D3-ABPI","Application-based Process Isolation",{"name":58},{"id":97,"name":98,"tactic":355},{"name":100},{"id":106,"name":107,"tactic":357},{"name":39},{"id":114,"name":115,"tactic":359},{"name":58},{"id":46,"name":47,"tactic":361},{"name":44},{"id":110,"name":111,"tactic":363},{"name":67},{"id":365,"name":366,"tactic":367},"D3-PSA","Process Spawn Analysis",{"name":39},{"id":55,"name":56,"tactic":369},{"name":58},{"id":371,"name":372,"techniques":373},"CAPEC-644","Use of Captured Hashes (Pass The Hash)",[374],{"id":375,"name":376,"tactics":377,"countermeasures":380},"T1550.002","Pass the Hash",[378,379],{"id":248,"name":249},{"id":134,"name":135},[381,383,385,387,389,391,393,395,397,399,401,403],{"id":327,"name":328,"tactic":382},{"name":44},{"id":315,"name":316,"tactic":384},{"name":44},{"id":299,"name":300,"tactic":386},{"name":44},{"id":291,"name":292,"tactic":388},{"name":39},{"id":337,"name":338,"tactic":390},{"name":39},{"id":331,"name":332,"tactic":392},{"name":44},{"id":319,"name":320,"tactic":394},{"name":58},{"id":323,"name":324,"tactic":396},{"name":58},{"id":287,"name":288,"tactic":398},{"name":58},{"id":365,"name":366,"tactic":400},{"name":39},{"id":351,"name":352,"tactic":402},{"name":58},{"id":343,"name":344,"tactic":404},{"name":58},{"id":406,"name":407,"techniques":408},"CAPEC-645","Use of Captured Tickets (Pass The Ticket)",[409],{"id":410,"name":411,"tactics":412,"countermeasures":415},"T1550.003","Pass the Ticket",[413,414],{"id":248,"name":249},{"id":134,"name":135},[416,418,420,422,424,426,428,430,432,434,436,438],{"id":287,"name":288,"tactic":417},{"name":58},{"id":315,"name":316,"tactic":419},{"name":44},{"id":351,"name":352,"tactic":421},{"name":58},{"id":299,"name":300,"tactic":423},{"name":44},{"id":343,"name":344,"tactic":425},{"name":58},{"id":365,"name":366,"tactic":427},{"name":39},{"id":331,"name":332,"tactic":429},{"name":44},{"id":319,"name":320,"tactic":431},{"name":58},{"id":291,"name":292,"tactic":433},{"name":39},{"id":327,"name":328,"tactic":435},{"name":44},{"id":337,"name":338,"tactic":437},{"name":39},{"id":323,"name":324,"tactic":439},{"name":58},{"id":441,"name":442,"techniques":443},"CAPEC-652","Use of Known Kerberos Credentials",[444],{"id":445,"name":446,"tactics":447,"countermeasures":449},"T1558","Steal or Forge Kerberos Tickets",[448],{"id":32,"name":33},[450,452,454,456,458,460,462,464,466,468,470,472,474,476,478,480,482,484,486,488,490],{"id":122,"name":123,"tactic":451},{"name":67},{"id":41,"name":42,"tactic":453},{"name":44},{"id":46,"name":47,"tactic":455},{"name":44},{"id":97,"name":98,"tactic":457},{"name":100},{"id":50,"name":51,"tactic":459},{"name":53},{"id":60,"name":61,"tactic":461},{"name":39},{"id":93,"name":94,"tactic":463},{"name":67},{"id":69,"name":70,"tactic":465},{"name":39},{"id":73,"name":74,"tactic":467},{"name":39},{"id":77,"name":78,"tactic":469},{"name":39},{"id":81,"name":82,"tactic":471},{"name":39},{"id":85,"name":86,"tactic":473},{"name":39},{"id":89,"name":90,"tactic":475},{"name":39},{"id":102,"name":103,"tactic":477},{"name":39},{"id":106,"name":107,"tactic":479},{"name":39},{"id":64,"name":65,"tactic":481},{"name":67},{"id":114,"name":115,"tactic":483},{"name":58},{"id":36,"name":37,"tactic":485},{"name":39},{"id":110,"name":111,"tactic":487},{"name":67},{"id":118,"name":119,"tactic":489},{"name":67},{"id":55,"name":56,"tactic":491},{"name":58},{"id":493,"name":494,"techniques":495},"CAPEC-701","Browser in the Middle (BiTM)",[],{"id":497,"name":498,"techniques":499},"CAPEC-94","Adversary in the Middle (AiTM)",[500],{"id":501,"name":502,"tactics":503,"countermeasures":506},"T1557","Adversary-in-the-Middle",[504,505],{"id":32,"name":33},{"id":168,"name":169},[507,509,511,513,515,517,519,521,523,525],{"id":55,"name":56,"tactic":508},{"name":58},{"id":69,"name":70,"tactic":510},{"name":39},{"id":73,"name":74,"tactic":512},{"name":39},{"id":77,"name":78,"tactic":514},{"name":39},{"id":81,"name":82,"tactic":516},{"name":39},{"id":85,"name":86,"tactic":518},{"name":39},{"id":89,"name":90,"tactic":520},{"name":39},{"id":102,"name":103,"tactic":522},{"name":39},{"id":106,"name":107,"tactic":524},{"name":39},{"id":152,"name":153,"tactic":526},{"name":39},[],[],[],[],[],[],"2026-08-14T21:32:18.055Z","Received",{"cisa_kev":536,"cisa_ransomware":536,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":537,"severity_score":538,"severity_version":539,"severity_source":540,"severity_vector":541,"severity_status":534},false,"critical",9.2,"v4.0","cve.org","CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",[543,549,554,559],{"url":544,"sources":545,"tags":547},"https://github.com/laravel/socialite/pull/789",[540,546],"nvd",[548],"Product",{"url":550,"sources":551,"tags":552},"https://github.com/laravel/socialite/commit/caf714f55d51ab0d914b40033d8b0f489d6219cc",[540,546],[553],"Patch",{"url":555,"sources":556,"tags":557},"https://github.com/laravel/socialite",[540,546],[558],"Vendor Advisory",{"url":560,"sources":561,"tags":562},"https://www.vulncheck.com/advisories/laravel-socialite-facebook-provider-authentication-bypass-via-nonce-replay",[540,546],[563],"Third Party Advisory",[],[],[567,576],{"source":540,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":568,"cvss_v4_0":574},{"baseScore":569,"baseSeverity":570,"vectorString":571,"impactScore":572,"exploitabilityScore":573},8.1,"HIGH","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",9.8,5.6,{"baseScore":538,"baseSeverity":575,"vectorString":541,"impactScore":9,"exploitabilityScore":9},"CRITICAL",{"source":546,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":577,"cvss_v4_0":578},{"baseScore":569,"baseSeverity":570,"vectorString":571,"impactScore":572,"exploitabilityScore":573},{"baseScore":538,"baseSeverity":575,"vectorString":579,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[581],{"ecosystem":9,"name":582,"vendor":583,"product":584,"cpe_part":585,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":586},"Socialite","laravel","socialite","a",[587],{"version":588,"is_range":589,"range_type":540,"version_start":9,"version_start_type":9,"version_end":590,"version_end_type":591,"fixed_in":9},"\u003C 5.29.0",true,"5.29.0","excluding"]