CVE-2026-34236: Auth0 PHP SDK Insufficient Entropy in Cookie Encryption
Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
Am I Affected? Consumers are affected if their application meets the following preconditions: - Their application is using the Auth0-PHP SDK, versions between 8.0.0 and 8.18.0 - Their application is using the Auth0-PHP SDK, or the following SDKs that rely on the Auth0-PHP SDK: - Auth0/symfony, - Auth0/laravel0-auth0, or - Auth0/wordpress
Resolution Upgrade Auth0/Auth0-PHP to version 8.19.0 or greater.
Other sources
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34236?
CVE-2026-34236 is considered a moderate severity vulnerability due to the risk of session cookie forgery.
How do I fix CVE-2026-34236?
To fix CVE-2026-34236, update the Auth0 PHP SDK to version 8.19.0 or later.
Which versions of Auth0 PHP SDK are affected by CVE-2026-34236?
Versions of Auth0 PHP SDK from 8.0.0 to 8.18.0 are affected by CVE-2026-34236.
What are the potential consequences of CVE-2026-34236?
The potential consequences of CVE-2026-34236 include unauthorized access and session hijacking due to cookie forgery.
Is my application using Auth0 PHP SDK vulnerable to CVE-2026-34236?
If your application uses Auth0 PHP SDK version between 8.0.0 and 8.18.0, it is vulnerable to CVE-2026-34236.