Auth0-PHP SDK has Improper Audience Validation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.
Summary
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| auth0 | auth0-PHP | 8.0.0 to before 8.18.0 | 8.18.0 | Patch available | CNA |
| — | auth0/auth0-php (Packagist) | 8.0.0 to before 8.18.0 | 8.18.0 | Patch available | GHSA-j2vm-wrq3-f7gf |
- auth0-PHP Vendorauth0 Affected 8.0.0 to before 8.18.0 Fixed in 8.18.0 Patch available CNA
- auth0/auth0-php (Packagist) Vendor— Affected 8.0.0 to before 8.18.0 Fixed in 8.18.0 Patch available GHSA-j2vm-wrq3-f7gf
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:auth0:auth0-php:*:*:*:*:*:*:*:* | 8.0.0 to before 8.18.0 | Vulnerable | auth0 |
| cpe:2.3:a:auth0:laravel-auth0:*:*:*:*:*:laravel:*:* | 7.0.0 to before 7.20.0 | Vulnerable | auth0 |
| cpe:2.3:a:auth0:symfony:*:*:*:*:*:*:*:* | 5.0.0 to before 5.6.0 | Vulnerable | auth0 |
| cpe:2.3:a:auth0:wp-auth0:*:*:*:*:*:wordpress:*:* | 5.0.0 to before 5.5.0 | Vulnerable | auth0 |
- cpe:2.3:a:auth0:auth0-php:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.18.0 Vulnerable ·auth0
- cpe:2.3:a:auth0:laravel-auth0:*:*:*:*:*:laravel:*:* Versions 7.0.0 to before 7.20.0 Vulnerable ·auth0
- cpe:2.3:a:auth0:symfony:*:*:*:*:*:*:*:* Versions 5.0.0 to before 5.6.0 Vulnerable ·auth0
- cpe:2.3:a:auth0:wp-auth0:*:*:*:*:*:wordpress:*:* Versions 5.0.0 to before 5.5.0 Vulnerable ·auth0
Remediation
- Fix · CNA auth0-PHP (auth0) Fixed in 8.18.0
- Fix · GHSA-j2vm-wrq3-f7gf auth0/auth0-php (Packagist) Fixed in 8.18.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-68129
- 2026-10-03 Alias added: GHSA-j2vm-wrq3-f7gf
References
Patch 4
- https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f
- https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3
- https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479
- https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de
Advisory 5
- https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf
- https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h
- https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g
- https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7
- https://nvd.nist.gov/vuln/detail/CVE-2025-68129
More Auth0-php vulnerabilities
- TI-2026-26531 Auth0 PHP SDK Insufficient Entropy in Cookie Encryption CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-68129 · CVE Program
- CVE-2025-68129 · NVD
- FIRST EPSS
- GHSA-j2vm-wrq3-f7gf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences