Auth0-PHP Insufficient Entropy in Cookie Encryption Vulnerability Allowing Session Forgery
Vulnerability
A vulnerability exists in the Auth0-PHP SDK for Auth0 Authentication and Management APIs, affecting versions 8.0.0 prior to 8.19.0. The issue arises because cookies are encrypted with inadequate entropy, potentially allowing threat actors to brute-force the encryption key and forge session cookies. This vulnerability is also present in applications using the Auth0-PHP SDK's dependent SDKs: Auth0/symfony, Auth0/laravel0-auth0, or Auth0/wordpress.
Impact
Exploitation of this vulnerability could lead to the forging of session cookies, allowing for unauthorized access to user sessions.
Remediation
Users can upgrade to Auth0-PHP version 8.19.0 or later to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.