vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-68129

Auth0-PHP SDK has Improper Audience Validation

HIGH
7.5
CVSS Score
Published: December 17, 2025 at 10:07 PM UTC
Updated: September 30, 2026 at 11:10 PM UTC
4 products affected across 1 vendorauth0-PHPWp AUTH0Laravel AUTH0

Using auth0-PHP by auth0?

Get instant alerts when new vulnerabilities affect auth0-PHP - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 0.4%
SSVC
No known exploit

Description

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

auth0-PHP· AUTH0
95%
v < 8.18.08.0.0 ≤ v < 8.18.0
Affected range stops below 8.18.0, so it looks safe — our inference, not a vendor statement
Laravel AUTH0· AUTH0composer
95%
7.0.0 ≤ v < 7.20.0
Affected range stops below 7.20.0, so it looks safe — our inference, not a vendor statement
Symfony· AUTH0
95%
5.0.0 ≤ v < 5.6.0
Affected range stops below 5.6.0, so it looks safe — our inference, not a vendor statement
Wp AUTH0· AUTH0
95%
5.0.0 ≤ v < 5.5.0
Affected range stops below 5.5.0, so it looks safe — our inference, not a vendor statement

References (12)

x_refsource_MISCPatch
Source: [email protected]
https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f
x_refsource_MISCProductRelease Notes
Source: [email protected]
https://github.com/auth0/auth0-PHP/releases/tag/8.18.0
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf
x_refsource_MISCPatch
Source: [email protected]
https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3
x_refsource_MISCProductRelease Notes
Source: [email protected]
https://github.com/auth0/laravel-auth0/releases/tag/7.20.0
x_refsource_MISCVendor Advisory
Source: [email protected]
https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h
x_refsource_MISCPatch
Source: [email protected]
https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479
x_refsource_MISCProductRelease Notes
Source: [email protected]
https://github.com/auth0/symfony/releases/tag/5.6.0

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusANALYZED
CWE
CWE-863

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card