Every CVESearch/Get API key

GHSA-98j6-67v3-mw34

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

9.3 CriticalFix available

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

  1. Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0.
  2. Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade Auth0/symfony to the latest version (v5.4.0).

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

What each source reports

GitHub Advisories Score used9.3

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

  1. Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0.
  2. Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade Auth0/symfony to the latest version (v5.4.0).

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Record
GHSA-98j6-67v3-mw34
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-502
Updated
2026-11-02
OSV9.3

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

  1. Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0.
  2. Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade Auth0/symfony to the latest version (v5.4.0).

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Record
GHSA-98j6-67v3-mw34
CVSS 4.0
9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Weakness
CWE-502
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
auth0/symfony
Packagist
5.0.0-BETA0 to 5.0.0
5.1.0
auth0/symfony
Packagist
5.0.0-BETA0 up to 5.1.0, plus listed versions
5.0.05.0.0-BETA1
5.1.0

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-98j6-67v3-mw34 is a critical vulnerability (CVSS 9.3) in auth0/symfony, published June 6, 2025. No source lists public exploit code. Fixed in auth0/symfony 5.1.0.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open