GHSA-vvg7-8rmq-92g7
Medium · 6.8CVSS
6.8
EPSS
—
Published
Dec 17, 2025
CISA due date
—
The record
Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | auth0/wordpress | 5.0.0-BETA0 | 5.5.0 |
| packagist | auth0/auth0-php | 8.0.0 | 8.18.0 |
| packagist | auth0/wordpress | 5.0.0-BETA0 | 5.5.0 |
Related vulnerabilities
- CVE-2025-68129 Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Same vulnerability
- GHSA-f3r2-88mq-9v4g Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK Also affects auth0/auth0-php
- GHSA-7hh9-gp72-wh7h Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency Also affects auth0/auth0-php
- GHSA-j2vm-wrq3-f7gf Auth0-PHP SDK has Improper Audience Validation Also affects auth0/auth0-php
- GHSA-39h7-pwv7-rc3x Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering) CWE-1395
- GHSA-hw5x-4r37-72w7 OpenTofu has unbounded memory usage, high CPU usage, or deadlock in "tofu init" with… CWE-1395
- GHSA-3hfp-gqgh-xc5g Axios supply chain attack - dependency in @lightdash/cli may resolve to compromised axios… CWE-1395
- GHSA-658g-p7jg-wx5g Axios npm Supply Chain Incident Impacting @usebruno/cli CWE-1395