GHSA-9fwj-9mjf-rhj3

laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

9.1 CriticalFix available

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

Applications using laravel-auth0 SDK with version <=7.16.0
laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
Session storage configured with CookieStore.

Fix Upgrade Auth0/laravel-auth0 to v7.17.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

What each source reports

GitHub Advisories Score used9.1

laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

Applications using laravel-auth0 SDK with version <=7.16.0
laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
Session storage configured with CookieStore.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Record: GHSA-9fwj-9mjf-rhj3
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

OSV9.1

laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.

Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions:

Applications using laravel-auth0 SDK with version <=7.16.0
laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
Session storage configured with CookieStore.

Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.

Record: GHSA-9fwj-9mjf-rhj3
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-287
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`auth0/login` Packagist	before 7.17.0	7.17.0
`auth0/login` Packagist	before 7.17.0, plus listed versions 1.0.31.0.41.0.51.0.61.0.7 Show 45 moreShow less 1.0.82.0.02.1.02.1.12.1.22.1.32.1.42.2.02.2.12.3.02.3.12.3.23.0.03.0.13.0.23.0.33.1.03.2.03.2.14.0.04.0.14.0.24.0.34.0.44.0.54.0.64.0.74.0.85.0.05.0.15.0.25.1.05.2.05.3.05.3.15.4.06.0.06.0.16.1.06.2.06.3.06.4.06.4.16.5.07.0.0	7.17.0

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-9fwj-9mjf-rhj3 is a critical vulnerability (CVSS 9.1) in auth0/login, published May 17, 2025. No source lists public exploit code. Fixed in auth0/login 7.17.0.

References

This page doesn't list everything

Left out here: 26 versions. The JSON record has them.