| Package | Affected versions | Patched versions |
|---|---|---|
| auth0/symfony | ≥ 5.0.0-BETA0, < 5.1.0 | 5.1.0 |
Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
Fix Upgrade Auth0/symfony to the latest version (v5.4.0).
Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free