CVE-2025-68129: Auth0-PHP SDK has Improper Audience Validation
(updated )
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.
References
- github.com/advisories/GHSA-j2vm-wrq3-f7gf
- github.com/auth0/auth0-PHP
- github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f
- github.com/auth0/auth0-PHP/releases/tag/8.18.0
- github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf
- github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3
- github.com/auth0/laravel-auth0/releases/tag/7.20.0
- github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h
- github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479
- github.com/auth0/symfony/releases/tag/5.6.0
- github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g
- github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de
- github.com/auth0/wordpress/releases/tag/5.5.0
- github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7
- nvd.nist.gov/vuln/detail/CVE-2025-68129
Code Behaviors & Features
Detect and mitigate CVE-2025-68129 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →