Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK CVE-2025-47275 - May 15, 2025

Description

Session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Affected versions

You are affected if you meet the following pre-conditions:

Applications using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK: a. Auth0/symfony, b. Auth0/laravel-auth0, c. Auth0/wordpress,
Session storage configured with CookieStore.

Fix

Upgrade Auth0/Auth0-PHP to version 8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement

Okta would like to thank Félix Charette for their discovery.

CVE details

CVE ID	CVE-2025-47275
Published Date	2025-05-15
Vulnerability Type	Brute-Forceable Session Authentication Tag
CWE	CWE-334 - Small Space of Random Values
CVSS v3	Score: 9.1 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK