PT-2025-23673 · Auth0 · Auth0/Wordpress+3

Kelvinzhu-Okta · Published 2025-06-03 · Updated 2025-06-06 · CVE-2025-48951

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Auth0-PHP versions 8.0.0-BETA3 through 8.14.0

Description The issue is due to insecure deserialization of cookie data. If exploited, a threat actor could send a specially crafted cookie containing malicious serialized data, as the SDK processes cookie content without prior authentication. Applications using the Auth0-PHP SDK, as well as those using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, are affected because they rely on the vulnerable Auth0-PHP SDK versions.

Recommendations For versions 8.0.0-BETA3 through 8.14.0, update to version 8.14.0 to patch the security flaw. As a temporary workaround, consider restricting the processing of cookie content to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

CWE-1395

Related Identifiers

CVE-2025-48951

GHSA-862M-5253-832R

GHSA-98J6-67V3-MW34

GHSA-C42H-56WX-H85Q

GHSA-V9M8-9XXP-Q492

Affected Products

Auth0-Php

Auth0/Laravel-Auth0

Auth0/Symfony

Auth0/Wordpress

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48951.json · Exploit
• https://osv.dev/vulnerability/GHSA-v9m8-9xxp-q492 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48951 · Security Note
• https://osv.dev/vulnerability/GHSA-c42h-56wx-h85q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48951 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-862m-5253-832r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-98j6-67v3-mw34 · Vendor Advisory
• https://github.com/auth0/auth0-PHP · Note
• https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389 · Note
• https://github.com/auth0/auth0-PHP/security/advisories/GHSA-v9m8-9xxp-q492 · Note
• https://github.com/auth0/auth0-PHP/commit/04b1f5daa8bdfebc5e740ec5ca0fb2df1648a715 · Note
• https://github.com/auth0/laravel-auth0 · Note
• https://github.com/auth0/laravel-auth0/security/advisories/GHSA-c42h-56wx-h85q · Note
• https://github.com/auth0/wordpress · Note
• https://github.com/auth0/wordpress/security/advisories/GHSA-862m-5253-832r · Note