CVE-2025-47275 json
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
published 2025-05-15 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-28079 , GHSA-g98g-r7gf-2r25
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected.
Patch / fix
- packagist auth0/auth0-php 8.14.0
- auth0 auth0-php 8.14.0
- auth0 laravel-auth0 7.17.0
- auth0 symfony 5.4.0
- auth0 wordpress 5.3.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 17 mo ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | auth0/auth0-php | >=8.0.0-BETA1, <8.14.0 |
8.14.0 |
Affected products
- auth0 auth0-PHP
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389
web
-
github.com
/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
web
-
github.com
/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3
web
-
github.com
/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch
web
-
github.com
/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q
web
-
github.com
/auth0/auth0-PHP/releases/tag/8.14.0
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-47275
advisory
-
github.com
/auth0/auth0-PHP
package
Sources
- CVE List CVE-2025-47275
- GitHub Advisory GHSA-g98g-r7gf-2r25
- NVD CVE-2025-47275
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.