Read the docs
TI-2025-43680 Aliases GHSA-c42h-56wx-h85q

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Priority LOW 38CWE-1395Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Code execution
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-502.

Summary

**Overview** The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. **Am I Affected?** You are affected by this vulnerability if you meet the following preconditions: 1. Applications using laravel-auth0 SDK, versions between 7.0.0-BETA1 to 7.2.1. 2. Laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0. **Fix** Upgrade Auth0/laravel-auth0 to the latest version (v7.17.0). **Acknowledgement** Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Why it matters now

Fix Fixed auth0/login (Packagist): 7.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—auth0/login (Packagist)7.0.0-BETA1 to before 7.2.27.2.2Patch availableGHSA-c42h-56wx-h85q
  • auth0/login (Packagist) Vendor— Affected 7.0.0-BETA1 to before 7.2.2 Fixed in 7.2.2 Patch available GHSA-c42h-56wx-h85q

Remediation

  • Fix · GHSA-c42h-56wx-h85q auth0/login (Packagist) Fixed in 7.2.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-c42h-56wx-h85q

References

Advisory 1

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences