# CVE-2025-68129: Auth0-PHP SDK has Improper Audience Validation

Source: https://junglewise.ai/threats/cve-2025-68129-auth0-php-sdk-has-improper-audience-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-17  
License: CC BY 4.0 with a link back

CVE-2025-68129 · Severity: medium · CVSS 6.8 · Published 2025-12-17

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.

Technologies: [auth0/auth0-php (Packagist)](https://junglewise.ai/threats/technologies/auth0-auth0-php). Vendors: [Auth0](https://junglewise.ai/threats/vendors/auth0), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2025-68129 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68129 being exploited in the wild.

**How severe is CVE-2025-68129?** Medium severity, with a CVSS score of 6.8, published 17 December 2025.

**Which products and versions are affected?** auth0/auth0-php (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=8.18.0.

**Is there a fix for CVE-2025-68129?** Yes. auth0/auth0-php (Packagist): upgrade to 8.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-68129?** Check whether you run Auth0-Php, Auth0 Laravel-Auth0, Auth0 Symfony or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- auth0/auth0-php (Packagist): upgrade to 8.18.0 or later

  ```sh
  composer require auth0/auth0-php:^8.18.0
  ```


## Affected products

- Auth0-Php
- Auth0 Laravel-Auth0
- Auth0 Symfony
- Auth0 Wp-Auth0
- auth0/auth0-php (Packagist) ECOSYSTEM:introduced=8.0.0,fixed=8.18.0

## Identifiers

- CVE-2025-68129
- GHSA-j2vm-wrq3-f7gf

## Related threats

- [Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption](https://junglewise.ai/threats/cve-2026-34236-auth0-php-sdk-has-insufficient-entropy-in-cookie-encryption)
- [auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import](https://junglewise.ai/threats/cve-2025-58769-auth0-php-sdk-does-not-properly-handle-file-types-in-bulk-user)
- [Auth0-PHP SDK Deserialization of Untrusted Data vulnerability](https://junglewise.ai/threats/cve-2025-48951-auth0-php-sdk-deserialization-of-untrusted-data-vulnerability)
- [Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK](https://junglewise.ai/threats/cve-2025-47275-brute-force-authentication-tags-of-cookiestore-sessions-in-auth0)