PT-2026-29574 · Auth0+1 · Auth0-Php+3

Highjenny · Published 2026-04-01 · Updated 2026-04-08 · CVE-2026-34236

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Auth0-PHP versions 8.0.0 through 8.18.0 Description: The Auth0-PHP SDK uses insufficient entropy for cookie encryption. This could allow attackers to brute-force the encryption key and forge session cookies. This affects applications using Auth0-PHP versions 8.0.0 through 8.18.0, as well as applications using Auth0/symfony, Auth0/laravel0-auth0, or Auth0/wordpress which rely on the Auth0-PHP SDK. Recommendations: Upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.

Fix

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2026-34236

GHSA-W3WC-44P4-M4J7

Affected Products

Auth0-Php

Auth0/Laravel0-Auth0

Auth0/Symfony

Auth0/Wordpress

References · 7

• https://github.com/auth0/auth0-PHP/security/advisories/GHSA-w3wc-44p4-m4j7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34236 · Security Note
• https://osv.dev/vulnerability/GHSA-w3wc-44p4-m4j7 · Vendor Advisory
• https://github.com/auth0/auth0-PHP · Note
• https://github.com/auth0/auth0-PHP/releases/tag/8.19.0 · Note
• https://twitter.com/TheHackerWire/status/2039604240570818604 · Twitter Post
• https://twitter.com/integ_sec/status/2041891063829291439 · Twitter Post