What is the CVSS score of CVE-2026-34236?

CVE-2026-34236 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-34236?

Auth0 PHP SDK versions 8.0.0 through 8.18.x contain weak cookie encryption that allows authenticated network attackers to brute-force session keys and forge authentication tokens, potentially…. A patch is available.

How to fix or mitigate CVE-2026-34236?

Within 24 hours: inventory all applications and services using Auth0 PHP SDK and document current versions in use. Within 7 days: upgrade to Auth0 PHP SDK version 8.19.0 or later across all production and non-production environments. Within 30 days: conduct authentication audit to identify any suspicious session activity during the vulnerability exposure window and validate that no unauthorized cookies were generated.

PHP CVE-2026-34236

EUVD-2026-17979 HIGH

Insufficient Entropy (CWE-331)

2026-04-01 GitHub_M

GHSA-w3wc-44p4-m4j7

PHP Information Disclosure Auth0

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Apr 01, 2026 - 17:30 euvd

EUVD-2026-17979

Analysis Generated

Apr 01, 2026 - 17:30 vuln.today

CVE Published

Apr 01, 2026 - 17:04 nvd

HIGH 8.2

DescriptionGitHub Advisory

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.

AnalysisAI

Insufficient entropy in cookie encryption within Auth0 PHP SDK versions 8.0.0 through 8.18.x enables brute-force attacks against session cookie encryption keys, potentially allowing authenticated threat actors with network access to forge arbitrary session cookies and bypass authentication controls. Vendor-released patch available in version 8.19.0. No public exploit identified at time of analysis, though CVSS score of 8.2 reflects high severity due to potential for complete authentication bypass with cross-scope impact.

Technical ContextAI

The Auth0 PHP SDK (cpe:2.3:a:auth0:auth0-php) provides authentication and management API integration for PHP applications. This vulnerability stems from CWE-331 (Insufficient Entropy) in the cookie encryption implementation. When applications encrypt session cookies using weak or predictable key material, cryptographic operations become vulnerable to brute-force attacks. In this case, the SDK's cookie encryption mechanism between versions 8.0.0 and 8.18.x used insufficient randomness in key generation or key derivation, reducing the computational effort required for an attacker to recover encryption keys. Once the key is compromised, attackers can forge valid session cookies with arbitrary claims, effectively bypassing the authentication layer entirely. This affects any PHP application relying on Auth0 PHP SDK for session management within the affected version range.

RemediationAI

Organizations using Auth0 PHP SDK should immediately upgrade to version 8.19.0 or later, which addresses the insufficient entropy vulnerability through improved cryptographic key generation mechanisms. The patched version is available through Composer package management and documented in the release notes at https://github.com/auth0/auth0-PHP/releases/tag/8.19.0. After upgrading, invalidate all existing session cookies by rotating session secrets or implementing forced re-authentication to ensure no potentially compromised cookies remain valid. Review application logs for anomalous authentication patterns that might indicate prior exploitation attempts. No effective workarounds exist short of upgrading, as the vulnerability resides in core SDK cryptographic functions. Organizations unable to immediately upgrade should implement compensating controls such as enhanced session monitoring, reduced session timeouts, and strict IP-based access controls to limit exploitation opportunities until patching is complete.