CVE-2025-68129: 
PHP vulnerability analysis and mitigation

CVE-2025-68129 is an improper audience validation vulnerability in the Auth0-PHP SDK that allows applications to accept ID tokens in place of access tokens. Discovered and responsibly disclosed by Jafar Sadiq (iaf4r), it was published on December 17, 2025. Affected versions include Auth0-PHP SDK v8.0.0–v8.17.0, and dependent SDKs: Auth0/symfony v5.0.0–v5.5.0, Auth0/laravel-auth0 v7.0.0–v7.19.0, and Auth0/wordpress plugin v5.0.0-BETA0–v5.4.0. The GitHub Advisory Database rates this as Moderate with a CVSS v3.1 score of 6.8, while NVD assigns a score of 7.5 (High) (Github Advisory, Auth0 Advisory).

The root cause (CWE-863: Incorrect Authorization) lies in the Token.php file of the Auth0-PHP SDK, where the client ID was unconditionally appended to the audience array during token validation regardless of token type. This meant that when validating access tokens, the SDK would also accept the client ID as a valid audience — a claim that is present in ID tokens but not typically in access tokens — effectively allowing ID tokens to pass access token validation checks. The fix, introduced in commit 7fe7000, adds a conditional check so that the client ID is only added to the audience array for non-access token types (if ($this->type !== self::TYPE_ACCESS_TOKEN)). Exploitation requires an attacker to possess a valid ID token (i.e., low-privilege authenticated credentials) and submit it where an access token is expected (Auth0 Advisory, Patch Commit).

Successful exploitation allows an authenticated attacker to substitute an ID token for an access token, potentially gaining unauthorized access to protected API resources and endpoints that rely on proper token-type validation. This primarily affects confidentiality and integrity — sensitive data accessible via protected APIs could be exposed, and unauthorized actions could be performed on behalf of legitimate users. Availability is not impacted. The scope of affected applications is broad, spanning PHP applications built directly on Auth0-PHP as well as those using the Laravel, Symfony, and WordPress Auth0 integrations (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already hold valid (low-privilege) credentials to obtain an ID token, raising the practical bar for abuse. The EPSS score is approximately 0.062–0.087%, indicating a low near-term exploitation probability (Github Advisory).

1. Obtain valid credentials: The attacker must have a legitimate (low-privilege) account on the target Auth0-integrated application to obtain an ID token through the standard authentication flow.
2. Retrieve an ID token: After authenticating, capture the ID token issued by Auth0 (e.g., via the authorization code flow or implicit flow response).
3. Identify a protected API endpoint: Locate an API endpoint in the target application that validates bearer tokens using the vulnerable Auth0-PHP SDK (versions v8.0.0–v8.17.0).
4. Submit ID token as access token: Send an HTTP request to the protected endpoint with the ID token in the Authorization: Bearer <id_token> header, where an access token would normally be required.
5. Bypass audience validation: Because the vulnerable SDK incorrectly adds the client ID to the audience check for all token types, the ID token's audience claim satisfies the validation, and the request is accepted as authenticated.
6. Access protected resources: The attacker gains access to API resources or performs actions that should require a properly scoped access token (Auth0 Advisory, Patch Commit).

• Logs: Application logs showing API requests authenticated with tokens whose azp (authorized party) or aud claim matches only the client ID (typical of ID tokens) rather than an API audience identifier; repeated successful authentications to resource-server endpoints using tokens with typ: ID or missing scope claims.
• Network: Unusual patterns of API access from accounts that do not normally interact with specific protected endpoints; bearer tokens in API requests that, when decoded, contain nonce fields or at_hash claims (ID token-specific fields).
• Application Behavior: Access to protected resources by users whose roles or scopes would not normally permit such access, particularly if the token presented lacks expected scope values for the accessed resource.

The primary remediation is to upgrade to the patched versions of the affected SDKs: Auth0-PHP to v8.18.0 or later, Auth0/laravel-auth0 to v7.20.0 or later, Auth0/symfony to v5.6.0 or later, and Auth0/wordpress plugin to v5.5.0 or later. No configuration-based workaround is available; upgrading is the only effective fix. Organizations should prioritize patching applications that expose APIs protected by these SDKs, as those are the primary attack surface (Auth0 Advisory, Release 8.18.0).

Okta (Auth0's parent company) acknowledged the responsible disclosure by Jafar Sadiq (iaf4r) in the official security advisory. The vulnerability was published and patched simultaneously on December 17, 2025, with coordinated advisories released for all affected downstream SDKs. No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking (Auth0 Advisory).