CVE-2026-34236: Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
Summary
CVE-2026-34236: Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption. Affects auth0/auth0-php versions >= 8.0.0, < 8.19.0. Fixed in 8.19.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Auth0 PHP SDK is a widely used library that facilitates authentication and authorization in PHP applications. It provides developers with tools to integrate Auth0's identity management features seamlessly. However, versions between 8.0.0 and 8.18.0 have a critical vulnerability that compromises the security of session cookies due to insufficient entropy in cookie encryption.
Vulnerability Detail
The vulnerability arises from the use of weak entropy sources for encrypting cookies in applications utilizing the Auth0 PHP SDK. This weakness allows threat actors to potentially brute-force the encryption key, leading to the forgery of session cookies. If exploited, attackers could impersonate legitimate users, gaining unauthorized access to sensitive information and functionalities within the application.
How To Fix
Minimum fixed version
8.19.0
This is the first release that contains the fix.
composer require auth0/auth0-php:8.19.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version of the Auth0 PHP SDK.
Conclusion
The Auth0 PHP SDK vulnerability (CVE-2026-34236) poses a significant risk due to insufficient entropy in cookie encryption. It is crucial for developers using affected versions to upgrade to 8.19.0 or later to mitigate the risk of session cookie forgery. Regular monitoring for vulnerabilities is recommended to maintain application security.
See every vulnerability recorded for auth0/auth0-php →
FAQ
Versions between 8.0.0 and 8.18.0 of the Auth0 PHP SDK are affected by this vulnerability.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, attackers could forge session cookies, allowing them to impersonate users and gain unauthorized access to sensitive data and functionalities.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for auth0/auth0-php.
