~ / search / GHSA-j2vm-wrq3-f7gf

GHSA-j2vm-wrq3-f7gf

Auth0-PHP SDK has Improper Audience Validation

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-68129

Packages

EcosystemPackageAffectedFixed in
Packagist auth0/auth0-php >= 8.0.0, < 8.18.0 8.18.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Description In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. ### Affected product and versions Projects are affected if they meet the following preconditions: - Applications using the Auth0-PHP SDK, versions between v8.0.0 and v8.17.0, or - Applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: - a. Auth0/symfony, - b. Auth0/laravel-auth0, - c. Auth0/wordpress. ### Resolution Upgrade Auth0/Auth0-PHP to version 8.18.0 or greater. ### Acknowledgement Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

References

External links from the advisory. They lead to third-party sites.