Latest vulnerabilities for "auth0 auth0-php"

Where

Sort:

Versions

8.0.0

composer/auth0/auth0-phpAuth0 PHP SDK Insufficient Entropy in Cookie Encryption

Risk 86

Severity

9.8

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected? Consumers are affected if their application meets the following preconditions: - Their application is using the Auth0-PHP SDK, versions between 8.0.0 and 8.18.0 - Their application is using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK: - Auth0/symfony, - Auth0/laravel0-auth0, or - Auth0/wordpress

Resolution Upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.

1 / 2

Source: GitHub

First published (updated )

CVE-2026-34236

composer/auth0/auth0-phpAuth0-PHP SDK has Improper Audience Validation

Risk 43

Severity

7.5

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Description In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versions Projects are affected if they meet the following preconditions:

- Applications using the Auth0-PHP SDK, versions between v8.0.0 and v8.17.0, or - Applications using the following SDKs that rely on the Auth0-PHP SDK versions between v8.0.0 and v8.17.0: - a. Auth0/symfony, - b. Auth0/laravel-auth0, - c. Auth0/wordpress.

Resolution Upgrade Auth0/Auth0-PHP to version 8.18.0 or greater.

Acknowledgement Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

1 / 2

Source: GitHub

First published (updated )

CVE-2025-68129

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.