Auth0 PHP SDK Insufficient Entropy in Cookie Encryption CVE-2026-34236 - Apr 1, 2026

Description

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

Affected versions

You are affected if you meet the following preconditions:

Applications using the Auth0-PHP SDK, versions between 8.0.0 and 8.18.0
Applications using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK:
- Auth0/symfony,
- Auth0/laravel0-auth0, or
- Auth0/wordpress

Resolution

Upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.

CVE details

CVE ID	CVE-2026-34236
Published Date	2026-04-01
Vulnerability Type	Insufficient Entropy in Cookie Encryption
CWE	CWE-331 - Insufficient Entropy
CVSS v3	Score: 8.2 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

References

Auth0 PHP SDK Insufficient Entropy in Cookie Encryption