GitHub Advisoryadvisory · Packagist

GHSA-w3wc-44p4-m4j7 Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption

HIGH Published 2026-04-01 Modified 2026-04-01 Official page ↗
Aliases
CVE-2026-34236
Ecosystem
Packagist
Packages
auth0/auth0-php
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-331
Reviewed
2026-04-01

Affected packages

• Packagist auth0/auth0-php: >= 8.0.0, < 8.19.0 → fixed in 8.19.0

Description

Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected? Consumers are affected if their application meets the following preconditions: • Their application is using the Auth0-PHP SDK, versions between 8.0.0 and 8.18.0 • Their application is using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK: • Auth0/symfony, • Auth0/laravel0-auth0, or • Auth0/wordpress Resolution Upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.

Related

Alias · CVE (1)

  • CVE-2026-34236 Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. vulnerability

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

References