TI-2026-26531 Aliases CVE-2026-34236 GHSA-w3wc-44p4-m4j7

Auth0 PHP SDK Insufficient Entropy in Cookie Encryption

MEDIUM 42CWE-331Published 2026-04-01 · Updated 2026-04-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00225 13th percentileScored 2026-11-07

Fix Fixed auth0-PHP (auth0): 8.19.0auth0/auth0-php (Packagist): 8.19.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
auth0	auth0-PHP	8.0.0 to before 8.19.0	8.19.0	Patch available	CNA
—	auth0/auth0-php (Packagist)	8.0.0 to before 8.19.0	8.19.0	Patch available	GHSA-w3wc-44p4-m4j7

auth0-PHP Vendorauth0 Affected 8.0.0 to before 8.19.0 Fixed in 8.19.0 Patch available CNA
auth0/auth0-php (Packagist) Vendor— Affected 8.0.0 to before 8.19.0 Fixed in 8.19.0 Patch available GHSA-w3wc-44p4-m4j7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:auth0:auth0-php::::::::	8.0.0 to before 8.19.0	Vulnerable	auth0

cpe:2.3:a:auth0:auth0-php:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.19.0 Vulnerable ·auth0

Remediation

Fix · CNA auth0-PHP (auth0) Fixed in 8.19.0
Fix · GHSA-w3wc-44p4-m4j7 auth0/auth0-php (Packagist) Fixed in 8.19.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-34236
2026-10-03 Alias added: GHSA-w3wc-44p4-m4j7

References

Advisory 2

Other 2

TI-2025-41710 Auth0-PHP SDK has Improper Audience Validation CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences