CVE-2025-68129 Auth0-PHP SDK has Improper Audience Validation

What is CVE-2025-68129?

CVE-2025-68129 is a medium-severity authentication bypass vulnerability in auth0-PHP, published on 17 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.

Weakness: CWE-863

Which versions are affected by CVE-2025-68129?

2 open source packages ship an affected version, including auth0/auth0-php. It affects 4 products.

Products include Auth0 Auth0-Php, Auth0 Laravel-Auth0, Auth0 Symfony, Auth0 Wp-Auth0.

How do I fix CVE-2025-68129?

Upgrade auth0/auth0-php to 8.18.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2025-68129 being exploited?

There is no known exploitation of CVE-2025-68129 in the wild and no public exploit code.

Other vulnerabilities in auth0-PHP

• CVE-2026-34236 Auth0 PHP SDK Insufficient Entropy in Cookie Encryption High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j2vm-wrq3-f7gf.