auth0/login

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Impact

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Am I Affected?

You are affected if you meet the following preconditions:

• Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
• Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.

Description

In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.

Affected product and versions

Users are affected if they meet the following preconditions:

• Applications using the Auth0 laravel-auth0 SDK with versions between 7.0.0 and 7.19.0,
• Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.

Resolution

Upgrade Auth0/laravel-auth0 to version 7.20.0 or greater.

Acknowledgement

Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible disclosure.

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 laravel-auth0 SDK with version between 4.0.0 and 7.18.0,
2. Auth0 laravel-auth0 SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0 laravel-auth0 SDK to version 7.19.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

1. Applications using laravel-auth0 SDK with version <=7.16.0
2. laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.