GHSA-fmg6-246m-9g2v
Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption
GHSA-fmg6-246m-9g2v is a high vulnerability (CVSS 8.2) in auth0/login, published April 3, 2026. No source lists public exploit code. Fixed in auth0/login 7.21.0.
- Severity
- 8.2 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
7.21.0auth0/login +1 more
Description
Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
Am I Affected?
You are affected if you meet the following preconditions:
- Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
- Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.
Resolution
Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
auth0/loginPackagist | 7.0.0 to 7.20.0 | 7.21.0 |
auth0/loginPackagist | 7.0.0 up to 7.21.0, plus listed versions 7.0.17.1.07.10.07.10.17.11.0 Show 23 moreShow less7.12.07.13.07.14.07.15.07.16.07.17.07.18.07.19.07.2.07.2.17.2.27.20.07.3.07.4.07.5.07.5.17.5.27.6.07.7.07.8.07.8.17.9.07.9.1 | 7.21.0 |
What each source reports
GitHub Advisories Score used
Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption
Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
Am I Affected?
You are affected if you meet the following preconditions:
- Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
- Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.
Resolution
Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.
- Record
GHSA-fmg6-246m-9g2v- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
OSV
Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption
Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
Am I Affected?
You are affected if you meet the following preconditions:
- Applications using laravel-auth0 SDK, versions between 7.0.0 and 7.20.0
- Laravel-auth0 SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.
Resolution
Upgrade Auth0/laravel-auth0 to version 7.21.0 or greater.
- Record
GHSA-fmg6-246m-9g2v- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N - Weakness
- CWE-331
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.