GCVE - cpe:2.3:a:auth0:auth0-php:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:auth0:auth0-php:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Auth0 (`bd827468-a826-51d4-9e05-912ec56b4756`)
Product	Auth0 Php (`5afc830b-486c-5431-8eab-e6ce9eaaf6b6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:composer/auth0/auth0-php`	purl2cpe	2026-06-01 10:16:14.260157
`pkg:github/auth0/auth0-php`	purl2cpe	2026-06-01 10:16:14.260159

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-34236`	vulnerable	2026-06-03 15:22:09.249149	Auth0 PHP SDK Insufficient Entropy in Cookie Encryption HIGH (8.2) Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0. Published: 2026-04-01T17:04:53.378Z Updated: 2026-04-01T17:59:59.001Z Open on db.gcve.eu Reference links https://github.com/auth0/auth0-PHP/security/advisories/GHSA-w3wc-44p4-m4j7 https://github.com/auth0/auth0-PHP/releases/tag/8.19.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-68129`	vulnerable	2026-06-03 15:11:02.878310	Auth0-PHP SDK has Improper Audience Validation MEDIUM (6.8) Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects are affected if they use Auth0-PHP SDK versions between v8.0.0 and v8.17.0, or applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: Auth0/symfony versions between 5.0.0 and 5.5.0, Auth0/laravel-auth0 versions between 7.0.0 and 7.19.0, and/or Auth0/wordpress plugin versions between 5.0.0-BETA0 and 5.4.0. Auth0/Auth0-PHP version 8.18.0 contains a patch for the issue. Published: 2025-12-17T22:07:35.645Z Updated: 2025-12-18T15:07:22.780Z Open on db.gcve.eu Reference links https://github.com/auth0/auth0-PHP/security/advisories/GHSA-j2vm-wrq3-f7gf https://github.com/auth0/laravel-auth0/security/advisories/GHSA-7hh9-gp72-wh7h https://github.com/auth0/symfony/security/advisories/GHSA-f3r2-88mq-9v4g https://github.com/auth0/wordpress/security/advisories/GHSA-vvg7-8rmq-92g7 https://github.com/auth0/auth0-PHP/commit/7fe700053aee609718460c123f00f53c511f0f7f	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-48951`	vulnerable	2026-06-03 15:01:43.799487	Auth0-PHP SDK Deserialization of Untrusted Data vulnerability Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Applications using the Auth0-PHP SDK are affected, as are applications using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, because those SDKsrely on the Auth0-PHP SDK versions from 8.0.0-BETA3 until 8.14.0. Version 8.3.1 contains a patch for the issue. Published: 2025-06-03T20:52:35.064Z Updated: 2025-06-04T20:32:18.609Z Open on db.gcve.eu Reference links https://github.com/auth0/auth0-PHP/security/advisories/GHSA-v9m8-9xxp-q492 https://github.com/auth0/laravel-auth0/security/advisories/GHSA-c42h-56wx-h85q https://github.com/auth0/symfony/security/advisories/GHSA-98j6-67v3-mw34 https://github.com/auth0/wordpress/security/advisories/GHSA-862m-5253-832r https://github.com/auth0/auth0-PHP/commit/04b1f5daa8bdfebc5e740ec5ca0fb2df1648a715	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-47275`	vulnerable	2026-06-03 15:01:28.729726	Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CRITICAL (9.1) Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected. Published: 2025-05-15T21:13:01.150Z Updated: 2025-05-22T20:03:34.201Z Open on db.gcve.eu Reference links https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25 https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3 https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.