PHP CVE-2026-34236

Auth0-PHP SDK versions 8.0.0 to 8.18.x. Attacker requires low-privilege authenticated access to the application. Attacker must brute-force the weakly-entropy-encrypted session cookies to forge sessions and escalate privileges.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N yields a base score of 8.2, indicating high severity with notable nuances. The Network attack vector (AV:N) means exploitation is remotely feasible without physical access. However, High attack complexity (AC:H) suggests successful exploitation requires specialized conditions such as computational resources for brute-forcing encryption keys or timing-specific network conditions. The requirement for Low privileges (PR:L) indicates attackers need some authenticated access initially, reducing the pool of potential threat actors but not eliminating insider or compromised-account scenarios. The Changed scope (S:C) is particularly concerning, as successful cookie forgery allows lateral movement beyond the vulnerable component's security boundary, potentially compromising entire authentication domains. High confidentiality and integrity impacts (C:H/I:H) reflect the ability to access sensitive data and modify authentication state. No public exploit identified at time of analysis and no CISA KEV listing, suggesting exploitation has not been observed in the wild. Real-world risk is elevated for applications with high-value authentication targets or those exposed to sophisticated threat actors capable of mounting brute-force cryptographic attacks, but mitigated by the attack complexity barrier and availability of a straightforward patch.

An authenticated low-privilege user with network access to an Auth0-integrated PHP application intercepts their own encrypted session cookie during legitimate authentication. Using the knowledge that cookies are encrypted with insufficient entropy (CWE-331), the attacker dedicates computational resources to brute-force the encryption key by testing candidate keys against the known cookie structure. Once the key is recovered-feasible due to the high attack complexity but not impossible for determined adversaries-the attacker crafts forged session cookies with elevated privileges or different user identities. These forged cookies bypass authentication controls entirely, granting unauthorized access to sensitive application resources across the authentication scope. The Changed scope impact means the attacker can potentially compromise multiple applications sharing the same Auth0 tenant or authentication domain.