GHSA-j2vm-wrq3-f7gf

Suggest an improvement
Source
https://github.com/advisories/GHSA-j2vm-wrq3-f7gf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-j2vm-wrq3-f7gf/GHSA-j2vm-wrq3-f7gf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j2vm-wrq3-f7gf
Aliases
Related
Published
2025-12-17T20:52:43Z
Modified
2026-02-04T04:07:36Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Auth0-PHP SDK has Improper Audience Validation
Details

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Projects are affected if they meet the following preconditions:

  • Applications using the Auth0-PHP SDK, versions between v8.0.0 and v8.17.0, or
  • Applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0:
    • a. Auth0/symfony,
    • b. Auth0/laravel-auth0,
    • c. Auth0/wordpress.

Resolution

Upgrade Auth0/Auth0-PHP to version 8.18.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Database specific 
{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-12-17T20:52:43Z",
    "nvd_published_at":  "2025-12-17T22:16:01Z",
    "severity":  "MODERATE"
}
References

Affected packages

Packagist / auth0/auth0-php

Package

Name
auth0/auth0-php
Purl
pkg:composer/auth0/auth0-php

Affected ranges

Type
ECOSYSTEM
Events
Introduced
8.0.0
Fixed
8.18.0

Affected versions

8.*
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/12/GHSA-j2vm-wrq3-f7gf/GHSA-j2vm-wrq3-f7gf.json"