netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-g98g-r7gf-2r25

Browse Source
This commit is contained in:
advisory-database[bot]
2025-05-22 20:04:55 +00:00
parent 0d33bada6c
commit 574985bd0a
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/05/GHSA-g98g-r7gf-2r25/GHSA-g98g-r7gf-2r25.json
+2 -2
View File
@@ -1,12 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g98g-r7gf-2r25",
"modified": "2025-05-16T17:48:55Z",
"modified": "2025-05-22T20:03:15Z",
"published": "2025-05-16T17:48:55Z",
"aliases": [
"CVE-2025-47275"
],
"summary": "Forgeable Encrypted Session Cookie in Apps Using Auth0-PHP SDK",
"summary": "Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK",
"details": "**Overview**\nSession cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.\n\n**Am I Affected?**\nYou are affected by this vulnerability if you meet the following pre-conditions:\n1. Applications using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK:\n a. Auth0/symfony,\n b. Auth0/laravel-auth0,\n c. Auth0/wordpress,\n2. Session storage configured with CookieStore.\n\n**Fix**\nUpgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.\n\n**Acknowledgement**\nOkta would like to thank Félix Charette for discovering this vulnerability.",
"severity": [
{