CVE-2025-48951 json
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
published 2025-06-03 17 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-16787 , GHSA-v9m8-9xxp-q492
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Applications using the Auth0-PHP SDK are affected, as are applications using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, because those SDKsrely on the Auth0-PHP SDK versions from 8.0.0-BETA3 until 8.14.0. Version 8.3.1 contains a patch for the issue.
Patch / fix
- packagist auth0/auth0-php 8.3.1
- auth0 auth0-php 8.3.1
- auth0 laravel-auth0 7.2.2
- auth0 symfony 5.1.0
- auth0 wordpress 5.1.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 17 mo ago
Exploit prediction
0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | auth0/auth0-php | >=8.0.0-BETA3, <8.3.1 |
8.3.1 |
Affected products
- auth0 auth0-PHP
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
github.com
/auth0/auth0-PHP/commit/04b1f5daa8bdfebc5e740ec5ca0fb2df1648a715
web
-
github.com
/auth0/auth0-PHP/security/advisories/GHSA-v9m8-9xxp-q492
web
-
github.com
/auth0/laravel-auth0/security/advisories/GHSA-c42h-56wx-h85q
web
-
github.com
/auth0/symfony/security/advisories/GHSA-98j6-67v3-mw34
web
-
github.com
/auth0/wordpress/security/advisories/GHSA-862m-5253-832r
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-48951
advisory
-
github.com
/auth0/auth0-PHP
package
Sources
- CVE List CVE-2025-48951
- GitHub Advisory GHSA-v9m8-9xxp-q492
- NVD CVE-2025-48951
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.