Skip to content
Fencer Intel
medium 6.8

GHSA-vvg7-8rmq-92g7 json

Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency

published 10mo ago modified 9mo ago

cvss
6.8
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Description In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

### Affected product and versions Projects are affected if they meet the following preconditions:

- Applications using the Auth0 Wordpress plugin with version between 5.0.0-BETA0 and 5.4.0, - Auth0 Wordpress plugin uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

### Resolution Upgrade Auth0 Wordpress plugin to version 5.5.0 or greater.

### Acknowledgement Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Patch / fix

  • packagist auth0/wordpress 5.5.0

Is GHSA-vvg7-8rmq-92g7 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by version score vector
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
packagist auth0/wordpress
>=5.0.0-BETA0, <5.5.0
5.5.0

Classification

Weakness
  • CWE-1395 Dependency on Vulnerable Third-Party Component
  • CWE-863 Incorrect Authorization

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.