CVE-2025-47275: Auth0-PHP SDK Session Cookie Vulnerability Leading to Unauthorized Access
Summary
CVE-2025-47275: Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK. Affects auth0/auth0-php versions >= 8.0.0-BETA1, < 8.14.0. Fixed in 8.14.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Auth0-PHP SDK is a widely used library for integrating authentication and authorization into PHP applications. It provides developers with tools to implement secure user authentication, manage sessions, and handle user data. However, a critical vulnerability has been identified in applications using this SDK when configured with CookieStore for session storage, which can lead to unauthorized access due to weak encryption mechanisms.
Vulnerability Detail
The vulnerability arises from the session cookies generated by the Auth0-PHP SDK, which are configured with CookieStore. These cookies contain authentication tags that can be brute-forced, allowing an attacker to gain unauthorized access to user sessions. This issue is particularly concerning for applications that rely on the integrity of session management for security. The vulnerability is classified under CWE-287, indicating improper authentication.
How To Fix
Minimum fixed version
8.14.0
This is the first release that contains the fix.
composer require auth0/auth0-php:8.14.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider switching to an alternative session storage mechanism instead of CookieStore until the upgrade can be applied. This may involve using database or file-based session storage to mitigate the risk associated with the vulnerable session cookies.
Conclusion
The Auth0-PHP SDK vulnerability (CVE-2025-47275) poses a critical risk to applications using CookieStore for session management. It is essential to upgrade to version 8.14.0 to mitigate this risk and ensure the security of user sessions. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for auth0/auth0-php →
FAQ
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
After upgrading to version 8.14.0, any previously issued session cookies will be rejected, requiring users to log in again.
Continuing to use the Auth0-PHP SDK without upgrading poses a significant security risk due to the potential for unauthorized access through brute-forced session cookies.
If an immediate upgrade is not possible, consider implementing a workaround by switching to a different session storage method to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/auth0-php.
