diff --git a/advisories/github-reviewed/2025/05/GHSA-g98g-r7gf-2r25/GHSA-g98g-r7gf-2r25.json b/advisories/github-reviewed/2025/05/GHSA-g98g-r7gf-2r25/GHSA-g98g-r7gf-2r25.json index b1bf488eea0..d32d4dd4c96 100644 --- a/advisories/github-reviewed/2025/05/GHSA-g98g-r7gf-2r25/GHSA-g98g-r7gf-2r25.json +++ b/advisories/github-reviewed/2025/05/GHSA-g98g-r7gf-2r25/GHSA-g98g-r7gf-2r25.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-g98g-r7gf-2r25", - "modified": "2025-05-16T17:48:55Z", + "modified": "2025-05-22T20:03:15Z", "published": "2025-05-16T17:48:55Z", "aliases": [ "CVE-2025-47275" ], - "summary": "Forgeable Encrypted Session Cookie in Apps Using Auth0-PHP SDK", + "summary": "Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK", "details": "**Overview**\nSession cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.\n\n**Am I Affected?**\nYou are affected by this vulnerability if you meet the following pre-conditions:\n1. Applications using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK:\n a. Auth0/symfony,\n b. Auth0/laravel-auth0,\n c. Auth0/wordpress,\n2. Session storage configured with CookieStore.\n\n**Fix**\nUpgrade Auth0/Auth0-PHP to v8.14.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.\n\n**Acknowledgement**\nOkta would like to thank Félix Charette for discovering this vulnerability.", "severity": [ {