p PatchFirst

CVE-2025-68129

CVE-2025-68129 · Auth0-PHP SDK has Improper Audience Validation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.

CVSS 6.8 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • auth0-php

    Versions
    • >= 8.0.0, < 8.18.0: Affected

    No fix published

  • auth0/auth0-php Packagist

    Versions
    • 8.0.0
    • 8.0.1
    • 8.0.2
    • 8.0.3
    • 8.0.4
    • 8.0.5
    • 8.0.6
    • 8.1.0
    • 8.10.0
    • 8.11.0
    • 8.11.1
    • 8.12.0
    • 8.13.0
    • 8.14.0
    • 8.15.0
    • 8.16.0
    • 8.17.0
    • 8.2.0
    • 8.2.1
    • 8.3.0
    • 8.3.1
    • 8.3.2
    • 8.3.3
    • 8.3.4
    • 8.3.5
    • 8.3.6
    • 8.3.7
    • 8.3.8
    • 8.4.0
    • 8.5.0
    • 8.6.0
    • 8.7.0
    • 8.7.1
    • 8.8.0
    • 8.9.0
    • 8.9.1
    • 8.9.3
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.18.0

    Update to 8.18.0

Original sources

Check your server →