Skip to content
Fencer Intel
medium 6.8

GHSA-f3r2-88mq-9v4g json

Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK

published 10mo ago modified 9mo ago

cvss
6.8
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Description In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

### Affected product and versions Projects are affected if they meet the following preconditions:

- Applications using the Auth0 Symfony SDK with versions between 5.0.0 and 5.5.0 - Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

### Resolution Upgrade Auth0/symfony to version 5.6.0 or greater.

### Acknowledgement Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Patch / fix

  • packagist auth0/symfony 5.6.0

Is GHSA-f3r2-88mq-9v4g in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
packagist auth0/symfony
>=5.0.0, <5.6.0
5.6.0

Classification

Weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component
  • CWE-345 Insufficient Verification of Data Authenticity
  • CWE-863 Incorrect Authorization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.