GHSA-hjfh-5jmm-xr24

Source

https://github.com/advisories/GHSA-hjfh-5jmm-xr24

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-hjfh-5jmm-xr24/GHSA-hjfh-5jmm-xr24.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hjfh-5jmm-xr24

Related

CVE-2025-58769

Published

2025-10-01T21:21:06Z

Modified

2026-02-04T04:40:03.690865Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

laravel-auth0 SDK Does Not Properly Handle File Types in Bulk User Import

Details

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0, 2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Database specific

{
    "cwe_ids": [
        "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-01T21:21:06Z",
    "severity": "LOW",
    "nvd_published_at": null
}

References

Affected packages

Packagist / auth0/login

Package

Name: auth0/login
Purl: pkg:composer/auth0/login

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.0.0

Fixed

7.19.0

Affected versions

4.*

4.0.0

4.0.1

4.0.2

4.0.3

4.0.4

4.0.5

4.0.6

4.0.7

4.0.8

5.*

5.0.0

5.0.1

5.0.2

5.1.0

5.2.0

5.3.0

5.3.1

5.4.0

6.*

6.0.0

6.0.1

6.1.0

6.2.0

6.3.0

6.4.0

6.4.1

6.5.0

7.*

7.0.0-BETA1

7.0.0-BETA2

7.0.0

7.0.1

7.1.0

7.2.0

7.2.1

7.2.2

7.3.0

7.4.0

7.5.0

7.5.1

7.5.2

7.6.0

7.7.0

7.8.0

7.8.1

7.9.0

7.9.1

7.10.0

7.10.1

7.11.0

7.12.0

7.13.0

7.14.0

7.15.0

7.16.0

7.17.0

7.18.0

Database specific

last_known_affected_version_range

"<= 7.18.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-hjfh-5jmm-xr24/GHSA-hjfh-5jmm-xr24.json"