VYPR
Get started
← All advisories
Moderate severityOSV Advisory· Published Dec 17, 2025· Updated Dec 18, 2025

Auth0-PHP SDK has Improper Audience Validation

CVE-2025-68129

Description

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
auth0/auth0-phpPackagist
>= 8.0.0, < 8.18.08.18.0

Affected products

1

Patches

4
b207c6f7fd06

fix(deps) : Update auth0/auth0-php for security fix

https://github.com/auth0/wordpressSnehil KishoreDec 16, 2025via ghsa
commit
1 file changed · +1 −1
  • composer.json+1 −1 modified
    @@ -36,7 +36,7 @@
         "php": "^8.1",
         "ext-json": "*",
         "ext-openssl": "*",
-        "auth0/auth0-php": "^8.17",
+        "auth0/auth0-php": "^8.18",
         "psr/cache": "^3.0"
     },
     "require-dev": {
0103d6f8dcef

fix(deps) : Update auth0/auth0-php for security fix

https://github.com/auth0/symfonySnehil KishoreDec 16, 2025via ghsa
commit
1 file changed · +1 −1
  • composer.json+1 −1 modified
    @@ -32,7 +32,7 @@
     "php": "^8.1",
     "ext-mbstring": "*",
     "ext-openssl": "*",
-    "auth0/auth0-php": "^8.17",
+    "auth0/auth0-php": "^8.18",
     "symfony/cache": "^6.4 || ^7.0",
     "symfony/framework-bundle": "^6.4 || ^7.0",
     "symfony/security-bundle": "^6.4 || ^7.0"
a1c3344dc0e5

fix(deps) : Update auth0/auth0-php for security fix

https://github.com/auth0/laravel-auth0Snehil KishoreDec 16, 2025via ghsa
commit
1 file changed · +1 −1
  • composer.json+1 −1 modified
    @@ -37,7 +37,7 @@
     "require": {
         "php": "^8.2",
         "ext-json": "*",
-        "auth0/auth0-php": "^8.17",
+        "auth0/auth0-php": "^8.18",
         "illuminate/contracts": "^11 || ^12",
         "illuminate/http": "^11 || ^12",
         "illuminate/support": "^11 || ^12",
7fe700053aee

fix: prevent adding client ID to audience for non-access tokens

https://github.com/auth0/auth0-PHPSnehil KishoreNov 21, 2025via ghsa
commit
1 file changed · +3 −1
  • src/Token.php+3 −1 modified
    @@ -260,7 +260,9 @@ public function validate(
         $tokenOrganization ??= $this->configuration->getOrganization() ?? null;
         $tokenMaxAge ??= $this->configuration->getTokenMaxAge() ?? null;
         $tokenLeeway ??= $this->configuration->getTokenLeeway() ?? 60;
-        $tokenAudience[] = (string) $this->configuration->getClientId();
+        if ($this->type !== self::TYPE_ACCESS_TOKEN) {
+            $tokenAudience[] = (string) $this->configuration->getClientId();
+        }
         $tokenAudience = array_unique($tokenAudience);
 
         $validator = $this->getParser()->validate();

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

14

News mentions

0

No linked articles in our index yet.