CVE Feed

    Dashboard / CVE / CVE-2025-68129

    CVE-2025-68129

    Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.

    Published:Dec 17, 2025
    Last Modified:Mar 5, 2026
    EPS:Dec 17, 2025
    EPSS Score:0.00112
    CVSS Score:6.8

    Affected Products

    Vendor
    Auth0
    Product
    Auth0-php
    Vendor
    Auth0
    Product
    Laravel-auth0
    Vendor
    Auth0
    Product
    Symfony
    Vendor
    Auth0
    Product
    Wp-auth0

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-863 Incorrect Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f
    https://github.com/auth0/auth0-PHP/releases/tag/8.18.0
    https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf
    https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3
    https://github.com/auth0/laravel-auth0/releases/tag/7.20.0
    https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h
    https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479
    https://github.com/auth0/symfony/releases/tag/5.6.0
    https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g
    https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de
    https://github.com/auth0/wordpress/releases/tag/5.5.0
    https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High