| Package | Affected versions | Patched versions |
|---|---|---|
| auth0/symfony | ≥ 5.0.0, < 5.8.0 | 5.8.0 |
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
Consumers are affected if their application meets the following preconditions:
Upgrade Auth0/symfony-auth0 to version 5.8.0 or greater.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free