Description

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Affected versions

You are affected if you meet the following preconditions:

• Applications using the Auth0-PHP SDK, versions between 8.0.0 and 8.18.0

• Applications using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK:

  • Auth0/symfony,

  • Auth0/laravel0-auth0, or

  • Auth0/wordpress

Resolution

Upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.

CVE details

References

Auth0 PHP SDK Insufficient Entropy in Cookie Encryption