CVE-2025-68129: Auth0-PHP SDK has Improper Audience Validation

CVE-2025-68129 · Severity: medium · CVSS 6.8 · Published 2025-12-17

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.

Technologies: auth0/auth0-php (Packagist). Vendors: Auth0, Packagist.

Quick answers

Is CVE-2025-68129 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-68129 being exploited in the wild.
How severe is CVE-2025-68129?
Medium severity, with a CVSS score of 6.8, published 17 December 2025.
Which products and versions are affected?
auth0/auth0-php (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=8.18.0.
Is there a fix for CVE-2025-68129?
Yes. auth0/auth0-php (Packagist): upgrade to 8.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2025-68129?
Check whether you run Auth0-Php, Auth0 Laravel-Auth0, Auth0 Symfony or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • auth0/auth0-php (Packagist): upgrade to 8.18.0 or later
    composer require auth0/auth0-php:^8.18.0

Affected products

  • Auth0-Php
  • Auth0 Laravel-Auth0
  • Auth0 Symfony
  • Auth0 Wp-Auth0
  • auth0/auth0-php (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=8.18.0

Identifiers

  • CVE-2025-68129
  • GHSA-j2vm-wrq3-f7gf

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.