CVE-2026-34236

HIGH

8.2

Descripcion

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.

Detalles CVE

Puntuacion CVSS v3.18.2

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Vector de ataqueNETWORK

ComplejidadHIGH

Privilegios requeridosLOW

Interaccion usuarioNONE

Publicado4/1/2026

Ultima modificacion4/3/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-331

Referencias

https://github.com/auth0/auth0-PHP/releases/tag/8.19.0(security-advisories@github.com)

https://github.com/auth0/auth0-PHP/security/advisories/GHSA-w3wc-44p4-m4j7(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.