CVE-2026-34236

Published: Apr 01, 2026 Last Modified: Apr 01, 2026
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,2
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: high
Integrity: high
Availability: none

Description

AI Translation Available

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.

331

Insufficient Entropy

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Other
Potential Impacts:
Bypass Protection Mechanism Other
Applicable Platforms
All platforms may be affected
View CWE Details
https://github.com/auth0/auth0-PHP/releases/tag/8.19.0
https://github.com/auth0/auth0-PHP/releases/tag/8.19.0
https://github.com/auth0/auth0-PHP/security/advisories/GHSA…
https://github.com/auth0/auth0-PHP/security/advisories/GHSA-w3wc-44p4-m4j7