Contact the journal editor (confidentially)
What you describe sounds very problematic, even after you tried to discuss the situation with your advisor. It sounds like you have already tried asking your advisor to clarify the situation, but his response was evasive, in that he did not confirm what (if anything) the 3rd party contributed in the capacity of co-author. Hence, as you say:
My understanding is that they have contributed nothing further to the paper.
You should try to ascertain whether that is the case by analysing the manuscript very carefully. Read it word for word, and check whether there is anything in there that you do not recognise as coming from yourself or from your advisor.
Of course, there is a (small) possibility that the advisor did involve the 3rd party in the process of making contributions that you believed to have come solely from your advisor, but if that were the case, your advisor should have mentioned to you that he had been involving a 3rd party at the time.
Personally, my view is that a person on the author list must be able to present on and answer detailed questions about all aspects (albeit allowing for some division of labour or specialisation, provided that everyone understands what is going on) of the work encapsulated in the paper (including exploratory work, investigative stages, and methodology), and it sounds like this 3rd party cannot do that.
So, my advice would be to contact the journal editor (confidentially) and explain the situation, forwarding all relevant correspondence and drafts in your possession. The editor, who should be familiar with what constitutes authorship and who should have the authority to ask tough questions, will then be able to investigate the issue properly and come to a determination of whether your advisor acted appropriately (based on the information you have given, the answer is probably "no", but it is difficult to be sure without seeing the details and asking tough questions of all parties concerned).
Of course, once you have taken the step of going to the editor, you (and your 'co-authors') will probably have to abide by whatever decision he/she makes. Depending on the details of the case, possible outcomes include:
- the editor retracts the article due to academic malpractice; or
- the editor publishes the article with just two authors (you and your advisor), and asks you to mention the 3rd party to the 'Acknowledgements' section instead; or
- the editor is satisfied with the explanations given by your advisor and publishes the article with all three parties as authors.
You should be prepared for the possibility that this will result in your "burning bridges" with your advisor. But to be honest, that might be a good thing (if it turns out that your advisor were corrupt); better to cut your losses now than to be tainted by corruption and blighted by toxic working relationships.