GHSA-w3wc-44p4-m4j7
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | auth0/auth0-php | >= 8.0.0, < 8.19.0 | 8.19.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
### Am I Affected?
Consumers are affected if their application meets the following preconditions:
- Their application is using the Auth0-PHP SDK, versions between 8.0.0 and 8.18.0
- Their application is using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK:
- Auth0/symfony,
- Auth0/laravel0-auth0, or
- Auth0/wordpress
### Resolution
Upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.
References
External links from the advisory. They lead to third-party sites.