Auth0-PHP SDK Improper Audience Validation Vulnerability

A vulnerability exists in the Auth0-PHP SDK for PHP, specifically in versions 8.0.0 prior to 8.17.0. This vulnerability arises from improper audience validation in access tokens, allowing affected applications to mistakenly accept ID tokens as access tokens. The issue also affects applications using Auth0-related SDKs or plugins that rely on vulnerable Auth0-PHP versions. The vulnerability has been patched in Auth0-PHP version 8.18.0.

Impact

Exploitation of this vulnerability could lead to improper authentication token validation, allowing applications to accept ID tokens as access tokens, which could be misused for unauthorized access or actions.

Remediation

Users can upgrade to Auth0-PHP version 8.18.0 or later. For applications using Auth0/Symfony, upgrade to version 5.6.0 or later. For those using Auth0/Laravel-Auth0, upgrade to version 7.20.0 or later. WordPress users should upgrade to version 5.5.0.