Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

auth0/auth0-php

5 known vulnerabilities (2 critical, 1 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 2 critical, 1 high, 1 medium, 1 low
Registry
Packagist

Advisories 5

  • Auth0 PHP SDK Insufficient Entropy in Cookie Encryption

    Affected: from 8.0.0, fixed in 8.19.0.

  • CVE-2025-68129Medium 6.8

    Auth0-PHP SDK has Improper Audience Validation

    Affected: from 8.0.0, fixed in 8.18.0.

  • auth0-PHP: Improper File Type Handling in Bulk User Import

    Affected: from 3.3.0, fixed in 8.17.0.

  • CVE-2025-48951Critical 9.3

    Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

    Affected: from 8.0.0-BETA3, fixed in 8.3.1.

  • CVE-2025-47275Critical 9.1

    Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK

    Affected: from 8.0.0-BETA1, fixed in 8.14.0.