CVE-2025-47275: Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK: a. Auth0/symfony, b. Auth0/laravel-auth0, c. Auth0/wordpress, 2. Session storage configured with CookieStore.
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.
Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.
Other sources
Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47275?
CVE-2025-47275 is classified as a medium severity vulnerability.
How do I fix CVE-2025-47275?
To mitigate CVE-2025-47275, upgrade the Auth0-PHP SDK to version 8.14.0 or later.
What software is affected by CVE-2025-47275?
CVE-2025-47275 affects the Auth0-PHP SDK versions between 8.0.0-BETA1 and 8.14.0.
What type of vulnerability is CVE-2025-47275?
CVE-2025-47275 is a session cookie vulnerability that allows brute force attacks on authentication tags.
Is my application vulnerable if I'm using Auth0-PHP SDK before version 8.14.0?
Yes, if you are using Auth0-PHP SDK versions prior to 8.14.0, your application is vulnerable to CVE-2025-47275.