6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7hh9-gp72-wh7h

GHSA-7hh9-gp72-wh7h: Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7hh9-gp72-wh7h

GHSA-7hh9-gp72-wh7h:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
auth0/login	composer	>= 7.0.0, < 7.20.0	7.20.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described in GHSA-7hh9-gp72-wh7h is an improper audience validation issue in the auth0/laravel-auth0 package, which stems from a dependency on the auth0/auth0-php SDK. The fix involves upgrading auth0/auth0-php from version 8.17.0 to 8.18.0.

My analysis focused on the code changes within the auth0/auth0-php repository between these two versions. By comparing the git tags for 8.17.0 and 8.18.0, I identified the specific commits that contain the security patch.

The key change is in the Auth0\SDK\Token::validate method. Before the patch, this function did not have a mechanism to differentiate an ID token from an access token when performing validation. An attacker could present an ID token, and the system would treat it as a valid access token.

The patch introduces a crucial check: when a token is being validated as an access token (TYPE_ACCESS_TOKEN), the code now inspects it for a nonce claim. The nonce claim is a standard part of the OpenID Connect (OIDC) specification for ID tokens to prevent replay attacks, but it is not expected in access tokens. If a nonce is found, the validation fails, and an InvalidTokenException is thrown.

This change directly addresses the root cause of the vulnerability by ensuring that ID tokens cannot be misused as access tokens, thus enforcing proper token type validation.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.