Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2025-47275
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-15 May, 2025 | 21:13
Updated At-22 May, 2025 | 20:03
Rejected At-
▼CVE Numbering Authority (CNA)
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected.

Affected Products
Vendor
auth0
Product
auth0-PHP
Versions
Affected
  • >= 8.0.0-BETA1, < 8.14.0
Problem Types
TypeCWE IDDescription
CWECWE-287CWE-287: Improper Authentication
Metrics
VersionBase scoreBase severityVector
3.19.1CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
x_refsource_CONFIRM
https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3
x_refsource_MISC
https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch
x_refsource_MISC
https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q
x_refsource_MISC
https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389
x_refsource_MISC
https://github.com/auth0/auth0-PHP/releases/tag/8.14.0
x_refsource_MISC
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found