Threat Intel

v0.1

← CVEs

CVE-2025-68129

MED 6.8
Published
2025-12-17
Last Modified
2026-03-05
Affected Apps
16
Affected Devices
29
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue.
Affected Applications in Environment 16
PHP v8.2.6
1 device
PHP v8.5.3
1 device
PHP v8.1.31
1 device
PHP v8.2.29
1 device
php v2:8.4+101~+ubuntu24.04.1+deb.sury.org+1
8 devices
php v2:8.4+100~+ubuntu24.04.1+deb.sury.org+1
1 device
php v5.4.16-48.el7
1 device
php v2:7.4+75
3 devices
php v2:8.4+101~+ubuntu22.04.1+deb.sury.org+1
1 device
php v2:8.2+93
1 device
php v1:7.0+35ubuntu6.1
1 device
php v2:8.4+96+ubuntu20.04.1+deb.sury.org+1
1 device
php v2:8.4+100~+ubuntu22.04.1+deb.sury.org+1
1 device
php v2:8.1+92ubuntu1
1 device
php v2:8.3+93ubuntu2
5 devices
php v1:7.2+60ubuntu1
1 device
Affected Devices 29
DPCPD-9XY54D4 Windows DPDNNR-L92359R7 Windows KRAID Windows LUTZLAB178544 Windows aggietower Linux ah-ots Linux cceredcapweb Linux guru.cluster Linux kena-utility Linux my1 Linux mysql02 Linux privatebin Linux rcbd Linux rcdb-dev Linux redcapweb Linux sys-serv-l-301-data Linux web04a Linux web06 Linux web08.usu.edu Linux web11.usu.edu Linux web13.usu.edu Linux web14.usu.edu Linux web20 Linux web22 Linux web28 Linux web29.usu.edu Linux web30.usu.edu Linux web37.usu.edu Linux webs.usu.edu Linux
References 12