Skip to content
Fencer Intel
medium 6.8

GHSA-7hh9-gp72-wh7h json

Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency

published 10mo ago modified 9mo ago

cvss
6.8
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Description In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

### Affected product and versions Users are affected if they meet the following preconditions:

- Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0, - Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

### Resolution Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

### Acknowledgement Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Patch / fix

  • packagist auth0/login 7.20.0

Is GHSA-7hh9-gp72-wh7h in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
packagist auth0/login
>=7.0.0, <7.20.0
7.20.0

Classification

Weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component
  • CWE-863 Incorrect Authorization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.