Critical Brute Force Vulnerability in laravel-auth0 SDK Affecting CookieStore Sessions
Summary
GHSA-9fwj-9mjf-rhj3: laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions. Affects auth0/login versions < 7.17.0. Fixed in 7.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The laravel-auth0 SDK is a popular library that integrates Auth0 authentication services into Laravel applications. It simplifies user authentication and management, providing features such as social login, user registration, and session management. However, certain configurations of this SDK, particularly those using CookieStore for session storage, are vulnerable to brute force attacks, which can lead to unauthorized access to user accounts.
Vulnerability Detail
The vulnerability arises from the authentication tags in session cookies when the laravel-auth0 SDK is configured with CookieStore. Specifically, versions of the SDK up to 7.16.0, when used with the Auth0-PHP SDK version 8.0.0-BETA1 or higher but below 8.14.0, are susceptible. Attackers can exploit this weakness to brute force the authentication tags, potentially gaining unauthorized access to user sessions. This vulnerability is classified as critical, with a CVSS score of 9.1, indicating a severe risk to applications that meet the specified conditions.
How To Fix
Minimum fixed version
7.17.0
This is the first release that contains the fix.
composer require auth0/login:7.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider switching session storage from CookieStore to an alternative method that does not expose session cookies to brute force attacks. This can be done by modifying the session configuration in your Laravel application to use a different driver, such as 'file' or 'database'.
Conclusion
The laravel-auth0 SDK is vulnerable to a critical brute force attack when configured with CookieStore sessions. It is essential for developers using affected versions to upgrade to version 7.17.0 or higher and consider rotating their cookie encryption keys to protect user sessions from unauthorized access.
See every vulnerability recorded for auth0/login →
FAQ
Versions of the laravel-auth0 SDK that are 7.16.0 or lower are affected by this vulnerability.
The CVSS score of this vulnerability is 9.1, indicating a critical level of risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider switching your session storage method to mitigate the risk temporarily.
Yes, upgrading to the patched version will invalidate all previous session cookies.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/login.
