Improper Audience Validation in Auth0-PHP SDK - Security Vulnerability
Summary
GHSA-j2vm-wrq3-f7gf: Auth0-PHP SDK has Improper Audience Validation. Affects auth0/auth0-php versions >= 8.0.0, < 8.18.0. Fixed in 8.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Auth0-PHP SDK is a popular library used for integrating Auth0 authentication into PHP applications. It provides developers with tools to manage user authentication, authorization, and session management. The SDK is widely utilized in various frameworks such as Symfony, Laravel, and WordPress. However, versions between 8.0.0 and 8.17.0 contain a vulnerability that allows improper audience validation, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from the improper validation of audience claims in access tokens within applications built using the Auth0-PHP SDK. This flaw allows affected applications to mistakenly accept ID tokens as access tokens, which can lead to unauthorized access and data breaches. The vulnerability is classified under CWE-863, indicating an issue with improper authorization. The CVSS score for this vulnerability is 6.8, indicating a moderate severity level.
How To Fix
Minimum fixed version
8.18.0
This is the first release that contains the fix.
composer require auth0/auth0-php:8.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, developers can implement additional checks to validate the audience claims in access tokens manually. However, this is not a substitute for upgrading to the patched version of the SDK.
Conclusion
The Auth0-PHP SDK vulnerability related to improper audience validation poses a significant risk to applications using affected versions. It is crucial for developers to upgrade to version 8.18.0 or higher to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for auth0/auth0-php →
FAQ
The Auth0-PHP SDK is a library that helps developers integrate Auth0 authentication into their PHP applications, providing tools for user management and session handling.
Versions between 8.0.0 and 8.17.0 of the Auth0-PHP SDK are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your composer.lock file, it can alert you to any vulnerabilities, including this one.
If an immediate upgrade is not possible, implement additional audience validation checks in your application as a temporary workaround.
The CVSS score for this vulnerability is 6.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/auth0-php.
