CVE-2025-48951: Auth0-PHP SDK Critical Deserialization Vulnerability
Summary
CVE-2025-48951: Auth0-PHP SDK Deserialization of Untrusted Data vulnerability. Affects auth0/auth0-php versions >= 8.0.0-BETA3, < 8.3.1. Fixed in 8.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Auth0-PHP SDK is a popular library used for integrating authentication and authorization into PHP applications. It provides developers with tools to manage user identities and secure access to applications. However, versions between 8.0.0-BETA3 and 8.3.0 are vulnerable to a critical issue involving insecure deserialization of cookie data, which can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the way the Auth0-PHP SDK processes cookie content without prior authentication. This insecure deserialization allows a threat actor to send a specially crafted cookie containing malicious serialized data. If exploited, this could lead to unauthorized access, data manipulation, or other malicious actions within the application.
How To Fix
Minimum fixed version
8.3.1
This is the first release that contains the fix.
composer require auth0/auth0-php:8.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional validation on cookie data before deserialization, although this is not a substitute for upgrading to the patched version.
Conclusion
The Auth0-PHP SDK has a critical vulnerability due to insecure deserialization of cookie data in versions 8.0.0-BETA3 to 8.3.0. It is essential to upgrade to version 8.3.1 or later to protect your application from potential exploitation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for auth0/auth0-php →
FAQ
Versions between 8.0.0-BETA3 and 8.3.0 are affected by this vulnerability.
Exploitation of this vulnerability could lead to unauthorized access, data manipulation, and other malicious actions within your application.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
While the best solution is to upgrade, you can implement additional validation on cookie data as a temporary workaround.
The vulnerability was discovered by Andreas Forsblom, and Okta has acknowledged his contribution.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/auth0-php.
