Loading story…
Laravel Socialite's Facebook provider was found to contain an authentication bypass vulnerability in its OpenID Connect handling, allowing replay of captured Facebook id_token values. The issue affects getUserByOIDCToken() in FacebookProvider.php, where the nonce claim was not validated; as a result, an attacker with a valid, unexpired token issued for the same Facebook App ID could submit it to the backend userFromToken() flow and still pass signature, audience, and issuer checks, potentially gaining unauthorized access to a victim account.
A fix was merged into the laravel/socialite project through pull request #789, titled "Validate Facebook OIDC token nonce", with merged commit caf714f. The patch adds nonce validation for Facebook OIDC tokens, addressing the replay condition described in the advisory and closing a gap that could let reused tokens authenticate successfully.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Laravel merged pull request #789 into the 5.x branch to validate the Facebook OIDC token nonce. The merge was performed by taylorotwell and shows merged commit caf714f.
VulnCheck published an advisory describing an authentication bypass in Laravel Socialite's Facebook provider caused by missing nonce validation in getUserByOIDCToken() within FacebookProvider.php. The flaw allows replay of valid, unexpired Facebook id_tokens for the same App ID, potentially leading to unauthorized account access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
vulncheck.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical authentication bypass vulnerability, tracked as **`CVE-2026-8457`**, affects the **WooCommerce - Social Login** WordPress plugin by WPWeb in all versions through **`2.8.7`**. The flaw allows unauthenticated attackers to log in as any existing WordPress user, including administrators, by forging an Apple **`id_token`** JWT with a victim's email address. Researchers said the plugin's Apple login handler decodes the token payload but does not verify the JWT signature against Apple's public keys or validate core claims such as issuer, audience, and expiry. The attack is further enabled by a login-flow nonce that is exposed to unauthenticated users through a localized JavaScript object on the login page. The issue has a **CVSS 9.8** rating and is classified as **`CWE-289`**, reflecting the risk of full account takeover and complete site compromise when an administrator account is targeted. The vulnerability is fixed in **`2.8.8`**, and public reporting said no active exploitation had been confirmed at the time of disclosure.
Aug 2, 2026
Three high-severity flaws in **LoginPress Pro** for WordPress can let unauthenticated attackers log in as existing site users, including administrators, by abusing weaknesses in the plugin’s OAuth-based social login flows. The issues, tracked as `CVE-2026-12595`, `CVE-2026-12597`, and `CVE-2026-12598`, affect versions through **6.2.3** and carry **CVSS 8.1** ratings. Researchers said the free version of LoginPress is not affected, while the premium plugin has more than **50,000 active installations**. The bypasses stem from insufficient verification of email data returned by OAuth providers. In the GitHub flow, the plugin trusts the first email returned by the `/user/emails` endpoint without confirming it is verified, while the Spotify Social Login addon accepts the email from Spotify’s `/v1/me` endpoint and uses it to identify and authenticate WordPress users. An attacker can add or create a matching email address on a third-party account and then trigger the OAuth callback to gain access as the targeted WordPress user. The vulnerabilities were disclosed through **Patchstack**, credited to **Dmitrii Ignatyev**, and fixed in **LoginPress Pro 6.2.4**; organizations that cannot patch immediately are advised to disable affected social login features.
Jul 10, 2026
A critical broken authentication flaw tracked as **CVE-2026-57807** affects the miniOrange **OAuth Single Sign On - SSO (OAuth Client)** WordPress plugin and allows unauthenticated remote attackers to compromise vulnerable sites. The issue impacts plugin versions **through 38.5.8** and is classified as **CWE-288**. According to public reporting and the CVE entry, the bug abuses the plugin's password recovery flow to let an attacker authenticate as arbitrary WordPress users, including administrators, creating a direct path to full website takeover. The vulnerability carries a **CVSS 9.8** rating and is considered low complexity and remotely exploitable with no user interaction required. Patchstack disclosed the issue and warned it is likely to face mass exploitation, while noting that no official vendor patch was available at the time of reporting. Defenders were urged to immediately remove the affected plugin or limit exposure to WordPress login and password recovery endpoints until miniOrange releases a fix; Patchstack also said it had issued a virtual patch for protected customers.
Jul 13, 2026