Auth0 Php
Monthly
Insufficient entropy in cookie encryption within Auth0 PHP SDK versions 8.0.0 through 8.18.x enables brute-force attacks against session cookie encryption keys, potentially allowing authenticated threat actors with network access to forge arbitrary session cookies and bypass authentication controls. Vendor-released patch available in version 8.19.0. No public exploit identified at time of analysis, though CVSS score of 8.2 reflects high severity due to potential for complete authentication bypass with cross-scope impact.
Improper audience validation in the Auth0-PHP SDK versions 8.0.0 through 8.17.0 causes the SDK's token validation routine to treat an ID token as an acceptable access token, so affected applications can be tricked into authorizing API requests with a token that was never meant to grant API access. The flaw is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5), but exploitation is gated by the attacker's ability to obtain a legitimately issued ID token for the target's own Auth0 tenant, since the token substitution only succeeds against the tenant that issued it. Confidentiality impact is high while integrity and availability are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis; the same defect propagates to Auth0's Laravel, Symfony and WordPress integrations that pin the vulnerable SDK range. Vendor-released patch: Auth0-PHP 8.18.0.
Insufficient entropy in cookie encryption within Auth0 PHP SDK versions 8.0.0 through 8.18.x enables brute-force attacks against session cookie encryption keys, potentially allowing authenticated threat actors with network access to forge arbitrary session cookies and bypass authentication controls. Vendor-released patch available in version 8.19.0. No public exploit identified at time of analysis, though CVSS score of 8.2 reflects high severity due to potential for complete authentication bypass with cross-scope impact.
Improper audience validation in the Auth0-PHP SDK versions 8.0.0 through 8.17.0 causes the SDK's token validation routine to treat an ID token as an acceptable access token, so affected applications can be tricked into authorizing API requests with a token that was never meant to grant API access. The flaw is reachable by unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5), but exploitation is gated by the attacker's ability to obtain a legitimately issued ID token for the target's own Auth0 tenant, since the token substitution only succeeds against the tenant that issued it. Confidentiality impact is high while integrity and availability are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis; the same defect propagates to Auth0's Laravel, Symfony and WordPress integrations that pin the vulnerable SDK range. Vendor-released patch: Auth0-PHP 8.18.0.