GitStock

auth0/auth0-php · Security

Auth0-PHP SDK has Improper Audience Validation

GHSA ID
GHSA-j2vm-wrq3-f7gf
CVE ID
CVE-2025-68129
Severity
medium
Published
Updated
CVSS
6.8 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v3
6.8 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Projects are affected if they meet the following preconditions:

  • Applications using the Auth0-PHP SDK, versions between v8.0.0 and v8.17.0, or
  • Applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0:
    • a. Auth0/symfony,
    • b. Auth0/laravel-auth0,
    • c. Auth0/wordpress.

Resolution

Upgrade Auth0/Auth0-PHP to version 8.18.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

CWEs

  • CWE-863 · Incorrect Authorization

References

Open GitHub