auth0/auth0-php
PHP SDK for Auth0 Authentication and Management APIs.
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 145
- Cadence
- ~17 days
- Last 12 months
- 14
Reach
- Stars
- 412
Details
- License
- MIT
- First release
- Jan 06, 2014
| Version | Released | |
|---|---|---|
9.4.0
minor
|
9.4.0
minor
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
9.3.0
minor
| ||
9.2.0
minor
|
9.2.0
minor
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
9.1.0
minor
| ||
9.0.0
major
|
9.0.0
major
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
9.0.0-beta.6
pre
| ||
9.0.0-beta.5
pre
|
9.0.0-beta.5
pre
Dependencies (9)
+ 1 more
Changelog
Compare changes
|
|
9.0.0-beta.4
pre
| ||
9.0.0-beta.3
pre
| ||
9.0.0-beta.2
pre
| ||
9.0.0-beta.1
pre
| ||
9.0.0-beta.0
pre
| ||
8.19.0
minor
| ||
8.18.0
minor
1 CVE
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev | ||
8.17.0
minor
2 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.16.0
minor
3 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.15.0
minor
3 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.14.0
minor
3 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.13.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.12.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.11.1
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.11.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.10.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.9.3
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.9.1
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.9.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.8.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.7.1
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.7.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.6.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.5.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.4.0
minor
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev |
8.4.0
minor
Dependencies (8)
Changelog
Compare changes
|
|
8.3.8
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.3.7
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.3.6
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.3.5
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.3.4
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.3.3
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.3.2
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.3.1
patch
4 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev |
8.3.1
patch
Dependencies (8)
Changelog
Compare changes
|
|
8.3.0
minor
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.2.1
patch
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.2.0
minor
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev |
8.2.0
minor
Dependencies (8)
Changelog
Compare changes
|
|
8.1.0
minor
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.0.6
patch
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.0.5
patch
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.0.4
patch
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.0.3
patch
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.0.2
patch
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev | ||
8.0.1
patch
5 CVEs
CVE-2026-34236
GHSA-w3wc-44p4-m4j7
Apr 01, 2026
Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption
8.2
/ 10
High
Network
High
Low
None
Changed
High
High
None
ImpactIn applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected?Consumers are affected if their application meets the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.19.0 or greater. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 26 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.18.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.19.0
References Updated Apr 01, 2026 · Source: OSV.dev
CVE-2025-68129
GHSA-j2vm-wrq3-f7gf
Dec 17, 2025
Auth0-PHP SDK has Improper Audience Validation
6.8
/ 10
Medium
Network
High
Low
None
Unchanged
High
High
None
DescriptionIn applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versionsProjects are affected if they meet the following preconditions:
ResolutionUpgrade Auth0/Auth0-PHP to version 8.18.0 or greater. AcknowledgementOkta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure. Affected versions
8.0.0
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
+ 25 more Show less
8.13.0
8.14.0
8.15.0
8.16.0
8.17.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.18.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-58769
GHSA-9mh6-g99m-ppcw
Oct 01, 2025
auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import
3.3
/ 10
Low
Network
High
High
None
Unchanged
Low
Low
None
OverviewIn applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected?You are affected by this vulnerability if you meet the following preconditions:
FixUpgrade Auth0/Auth0-PHP to version 8.17.0 or greater. AcknowledgementOkta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability. Affected versions
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
3.3.7
3.4.0
3.4.1
3.4.2
3.4.3
+ 87 more Show less
4.0.0
4.0.1
4.0.10
4.0.11
4.0.12
4.0.13
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.1.0
5.1.1
5.2.0
5.3.0
5.3.1
5.3.2
5.4.0
5.5.0
5.5.1
5.6.0
5.7.0
6.0.0-alpha.1
6.0.0-alpha.2
7.0.0
7.1.0
7.2.0
7.3.0
7.4.0
7.5.0
7.6.0
7.6.1
7.6.2
7.7.0
7.8.0
7.9.0
7.9.1
7.9.2
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
8.11.0
8.11.1
8.12.0
8.13.0
8.14.0
8.15.0
8.16.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.17.0
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-48951
GHSA-v9m8-9xxp-q492
Jun 04, 2025
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Critical
Network
Low
None
None
Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/Auth0-PHP to 8.3.1. Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0
Fixed in
8.3.1
References
Updated Feb 04, 2026 · Source: OSV.dev
CVE-2025-47275
GHSA-g98g-r7gf-2r25
May 16, 2025
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
9.1
/ 10
Critical
Network
Low
None
None
Unchanged
High
High
None
Overview Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:
Fix Upgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected. Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability. Affected versions
8.0.0
8.0.0-BETA1
8.0.0-BETA2
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.10.0
+ 24 more Show less
8.11.0
8.11.1
8.12.0
8.13.0
8.2.0
8.2.1
8.3.0
8.3.1
8.3.2
8.3.3
8.3.4
8.3.5
8.3.6
8.3.7
8.3.8
8.4.0
8.5.0
8.6.0
8.7.0
8.7.1
8.8.0
8.9.0
8.9.1
8.9.3
Fixed in
8.14.0
References
Updated Feb 04, 2026 · Source: OSV.dev |