CVE-2025-58769

auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. The vulnerability affects any application that either directly uses the Auth0-PHP SDK (versions 3.3.0–8.16.0) or indirectly relies on those versions through the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs. This issue is fixed in version 8.17.0.

• CWE-22
• CWE-73

• https://github.com/auth0/auth0-PHP/commit/9026da58f5c381cd4cb5932de829eff6eacbb65c
• https://github.com/auth0/auth0-PHP/releases/tag/8.17.0
• https://github.com/auth0/auth0-PHP/security/advisories/GHSA-9mh6-g99m-ppcw
• https://github.com/auth0/laravel-auth0/security/advisories/GHSA-hjfh-5jmm-xr24
• https://github.com/auth0/symfony/security/advisories/GHSA-7jp2-5h22-m432
• https://github.com/auth0/wordpress/security/advisories/GHSA-w22c-pw5m-482x

Published

Oct 1, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58763Tautulli is a Python based monitoring and tracking tool for …7.2
• CVE-2025-58764Claude Code is an agentic coding tool. Due to an error in co…9.8
• CVE-2025-58765wabac.js provides a full web archive replay system, or 'wayb…7.1
• CVE-2025-58766Dyad is a local AI app builder. A critical security vulnerab…9
• CVE-2025-58767REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 …5.3
• CVE-2025-58768DeepChat is a smart assistant uses artificial intelligence. …9.6
• CVE-2025-5877A vulnerability, which was classified as problematic, has be…8.1
• CVE-2025-58770APTIOV contains a vulnerability in BIOS where a user may cau…8.8
• CVE-2025-58775KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer ove…8.4
• CVE-2025-58776KV Studio versions 12.23 and prior contain a stack-based buf…8.4
• CVE-2025-58777VT Studio versions 8.53 and prior contain an access of unini…7.8
• CVE-2025-58778Multiple versions of RG-EST300 provided by Ruijie Networks p…8.6