Read the docs
TI-2025-43679 Aliases GHSA-98j6-67v3-mw34

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Priority LOW 38CWE-502Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Code execution
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-502.

Summary

**Overview** The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. **Am I Affected?** You are affected by this vulnerability if you meet the following preconditions: 1. Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0. 2. Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0. **Fix** Upgrade Auth0/symfony to the latest version (v5.4.0). **Acknowledgement** Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Why it matters now

Fix Fixed auth0/symfony (Packagist): 5.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—auth0/symfony (Packagist)5.0.0-BETA0 to before 5.1.05.1.0Patch availableGHSA-98j6-67v3-mw34
  • auth0/symfony (Packagist) Vendor— Affected 5.0.0-BETA0 to before 5.1.0 Fixed in 5.1.0 Patch available GHSA-98j6-67v3-mw34

Remediation

  • Fix · GHSA-98j6-67v3-mw34 auth0/symfony (Packagist) Fixed in 5.1.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-98j6-67v3-mw34

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences