Skip to content
OpenAdvisories

Product · auth0

auth0-PHP

4 known vulnerabilities.

auth0-PHP at a glance

Last 12 months
2
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202610
Mar 202600
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202511
May 202511
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.2
    CVE-2026-34236

    Auth0 PHP SDK Insufficient Entropy in Cookie Encryption

    Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing th…

    auth0 auth0-PHP auth0/auth0-php Packagist
  • Medium 6.8
    CVE-2025-68129

    Auth0-PHP SDK has Improper Audience Validation

    Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Acces…

    auth0 auth0-PHP auth0/auth0-php Web / CMS Packagist
  • Critical 9.3
    CVE-2025-48951

    Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

    Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a th…

    auth0 auth0-PHP auth0/auth0-php Packagist
  • Critical 9.1
    CVE-2025-47275

    Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

    Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be …

    auth0 auth0-PHP auth0/auth0-php Packagist