Vulnerability · Published Apr 1, 2026 · Assigned by GitHub_M

CVE-2026-34236Auth0 PHP SDK Insufficient Entropy in Cookie Encryption

High 8.2

In plain English

A high-severity security flaw in auth0-PHP from auth0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.2%top 86.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	auth0/auth0-php	8.19.0	GHSA-w3wc-44p4-m4j7

Affected products (as reported)

Vendor	Product	Versions
auth0	auth0-PHP	>= 8.0.0, < 8.19.0

Weakness: CWE-331 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/auth0/auth0-PHP/security/advisories/GHSA-w3wc-44p4-m4j7 x_refsource_CONFIRM
https://github.com/auth0/auth0-PHP/releases/tag/8.19.0 x_refsource_MISC