PT-2025-51935 · WordPress+1 · Auth0/Wordpress+3

Iaf4R + 1 · Published 2025-12-17 · Updated 2026-03-05 · CVE-2025-68129

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Auth0-PHP versions 8.0.0 through 8.17.0 Auth0/symfony versions 5.0.0 through 5.5.0 Auth0/laravel-auth0 versions 7.0.0 through 7.19.0 Auth0/wordpress plugin versions 5.0.0-BETA0 through 5.4.0

Description The Auth0-PHP SDK contains a flaw in how access token audience validation is handled. This improper validation can lead to applications incorrectly accepting ID tokens as access tokens. This affects applications built with the Auth0-PHP SDK and those utilizing integrations like Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress that depend on vulnerable versions of the Auth0-PHP SDK.

Recommendations Update Auth0-PHP to version 8.18.0 or later. Update Auth0/symfony to a version later than 5.5.0. Update Auth0/laravel-auth0 to a version later than 7.19.0. Update Auth0/wordpress plugin to a version later than 5.4.0.

Exploit

Fix

Incorrect Authorization

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-863

CWE-345

CWE-1395

Related Identifiers

CVE-2025-68129

GHSA-7HH9-GP72-WH7H

GHSA-F3R2-88MQ-9V4G

GHSA-J2VM-WRQ3-F7GF

GHSA-VVG7-8RMQ-92G7

Affected Products

Auth0-Php

Auth0/Laravel-Auth0

Auth0/Symfony

Auth0/Wordpress

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68129.json · Exploit
• https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf · Vendor Advisory
• https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f · Patch
• https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h · Vendor Advisory
• https://github.com/auth0/laravel-auth0/commit/a1c3344dc0e5a36e8f56c8cfc535728d3d7558f3 · Patch
• https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7 · Vendor Advisory
• https://github.com/auth0/wordpress/commit/b207c6f7fd06507b90c4e6bcc18a857ef9e018de · Patch
• https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g · Vendor Advisory
• https://github.com/auth0/symfony/commit/0103d6f8dcef6996653fad1f823d1c167f472479 · Patch
• https://osv.dev/vulnerability/GHSA-vvg7-8rmq-92g7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68129 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j2vm-wrq3-f7gf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68129 · Security Note
• https://osv.dev/vulnerability/GHSA-7hh9-gp72-wh7h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f3r2-88mq-9v4g · Vendor Advisory