GHSA-7hh9-gp72-wh7h Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency
Attackers can bypass audience validation to use ID tokens as Access tokens, potentially gaining unauthorized access to protected resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7hh9-gp72-wh7h?
GHSA-7hh9-gp72-wh7h is an authentication bypass vulnerability in auth0/login, published on 17 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.
Affected product and versions
Users are affected if they meet the following preconditions:
- Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
- Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.
Resolution
Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.
Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.
Which versions are affected by GHSA-7hh9-gp72-wh7h?
2 open source packages ship an affected version, including auth0/login.
| Package | Affected | Fixed in |
|---|---|---|
auth0/login Packagist | From 7.0.0 | 7.20.0 |
auth0/login Packagist | From 7.0.0 | 7.20.0 |
How do I fix GHSA-7hh9-gp72-wh7h?
Upgrade auth0/login to 7.20.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-7hh9-gp72-wh7h being exploited?
There is no known exploitation of GHSA-7hh9-gp72-wh7h in the wild and no public exploit code.