-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the auth0/auth0-php package, which is a dependency of auth0/symfony. The advisory for auth0/symfony points to a patch that simply bumps the version of auth0/auth0-php. By analyzing the commits between the vulnerable version (8.17.0) and the patched version (8.18.0) of auth0/auth0-php, I identified the exact changes that address the vulnerability. The core of the fix is in the validate method of the Auth0\SDK\Token class. The patch adds logic to detect if an ID token is being used as an access token by checking for a nonce claim, which should only be present in ID tokens. If a nonce is found in a token being validated as an access token, an exception is thrown. This indicates that the validate function was the point of failure, as it previously lacked this critical validation step, allowing for improper token type acceptance.
Auth0\SDK\Token::validatesrc/Token.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| auth0/symfony | composer | >= 5.0.0, <= 5.5.0 | 5.6.0 |