CVE-2025-68129

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-68129", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-12-15T18:05:52.209Z", "datePublished": "2025-12-17T22:07:35.645Z", "dateUpdated": "2025-12-18T15:07:22.780Z"}, "containers": {"cna": {"title": "Auth0-PHP SDK has Improper Audience Validation", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf"}, {"name": "https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h"}, {"name": "https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g"}, {"name": "https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7"}, {"name": "https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f"}, {"name": "https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3"}, {"name": "https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479"}, {"name": "https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de"}, {"name": "https://github.com/auth0/auth0-PHP/releases/tag/8.18.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/auth0-PHP/releases/tag/8.18.0"}, {"name": "https://github.com/auth0/laravel-auth0/releases/tag/7.20.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/laravel-auth0/releases/tag/7.20.0"}, {"name": "https://github.com/auth0/symfony/releases/tag/5.6.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/symfony/releases/tag/5.6.0"}, {"name": "https://github.com/auth0/wordpress/releases/tag/5.5.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/auth0/wordpress/releases/tag/5.5.0"}], "affected": [{"vendor": "auth0", "product": "auth0-PHP", "versions": [{"version": ">= 8.0.0, < 8.18.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-17T22:07:35.645Z"}, "descriptions": [{"lang": "en", "value": "Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue."}], "source": {"advisory": "GHSA-j2vm-wrq3-f7gf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-18T14:53:59.445866Z", "id": "CVE-2025-68129", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-18T15:07:22.780Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Auth0-PHP SDK has Improper Audience Validation", "source": {"advisory": "GHSA-j2vm-wrq3-f7gf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "auth0", "product": "auth0-PHP", "versions": [{"status": "affected", "version": ">= 8.0.0, < 8.18.0"}]}], "references": [{"url": "https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf", "name": "https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h", "name": "https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g", "name": "https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7", "name": "https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f", "name": "https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3", "name": "https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479", "name": "https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de", "name": "https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/auth0-PHP/releases/tag/8.18.0", "name": "https://github.com/auth0/auth0-PHP/releases/tag/8.18.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/laravel-auth0/releases/tag/7.20.0", "name": "https://github.com/auth0/laravel-auth0/releases/tag/7.20.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/symfony/releases/tag/5.6.0", "name": "https://github.com/auth0/symfony/releases/tag/5.6.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/auth0/wordpress/releases/tag/5.5.0", "name": "https://github.com/auth0/wordpress/releases/tag/5.5.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-12-17T22:07:35.645Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68129", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-18T14:53:59.445866Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-12-18T14:54:06.930Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-68129", "state": "PUBLISHED", "dateUpdated": "2025-12-17T22:07:35.645Z", "dateReserved": "2025-12-15T18:05:52.209Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-12-17T22:07:35.645Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "auth0-PHP", "vendor": "auth0", "versions": [{"status": "affected", "version": ">= 8.0.0, < 8.18.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:auth0:auth0-php:*:*:*:*:*:*:*:*", "matchCriteriaId": "12378349-3A0C-4E82-9568-C0B4B775F1F4", "versionEndExcluding": "8.18.0", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:auth0:laravel-auth0:*:*:*:*:*:laravel:*:*", "matchCriteriaId": "01BEB1D0-CD7D-4223-ADC3-7DB8DB852867", "versionEndExcluding": "7.20.0", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:auth0:symfony:*:*:*:*:*:*:*:*", "matchCriteriaId": "1093AE14-FD36-4E4D-983E-48D4CCE77D49", "versionEndExcluding": "5.6.0", "versionStartIncluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:auth0:wp-auth0:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "1C6C5FAD-40FC-4715-B4C1-419EC9AC51FB", "versionEndExcluding": "5.5.0", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue."}, {"lang": "es", "value": "Auth0-PHP es un SDK de PHP para las API de autenticaci\u00f3n y gesti\u00f3n de Auth0. En aplicaciones construidas con el SDK de Auth0-PHP, la validaci\u00f3n de audiencia en los tokens de acceso se realiza de forma incorrecta. Sin una validaci\u00f3n adecuada, las aplicaciones afectadas pueden aceptar tokens de ID como tokens de acceso. Los proyectos se ven afectados si utilizan versiones del SDK de Auth0-PHP entre v8.0.0 y v8.17.0, o aplicaciones que utilizan los siguientes SDK que dependen de las versiones del SDK de Auth0-PHP entre v8.0.0 y v8.17.0: versiones de Auth0/symfony entre 5.0.0 y 5.5.0, versiones de Auth0/laravel-auth0 entre 7.0.0 y 7.19.0, y/o versiones del plugin de WordPress de Auth0 entre 5.0.0-BETA0 y 5.4.0. La versi\u00f3n 8.18.0 de Auth0/Auth0-PHP contiene un parche para el problema."}], "id": "CVE-2025-68129", "lastModified": "2026-09-30T23:10:00.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-68129", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-18T14:53:59.445866Z", "version": "2.0.3"}}]}, "published": "2025-12-17T22:16:01.713", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/auth0/auth0-PHP/releases/tag/8.18.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/auth0/laravel-auth0/releases/tag/7.20.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/auth0/symfony/releases/tag/5.6.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/auth0/wordpress/releases/tag/5.5.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-12-18T09:56:01.693697+00:00", "updated": "2025-12-18T09:56:01.693722+00:00", "vendors": ["auth0", "auth0$PRODUCT$auth0-php"]}