AUTH0 Laravel-AUTH0 vulnerabilities

2 CVEs affecting AUTH0 Laravel-AUTH0, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-68129, published 2025-12-17.

More from AUTH0.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-68129, published 2025-12-17. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper…
• CVE-2025-58769, published 2025-10-01. Low severity, CVSS 3.3. EPSS: 0.4% chance of exploitation in the next 30 days. auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path…