Security Digest · Critical advisory (no CVE assigned)
GHSA-2f4r-34m4-3w8q: Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Overview Session cookies of applications using the Auth0 Wordpress plugin configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | auth0/wordpress | < 5.3.0 | 5.3.0 |
Details
Overview Session cookies of applications using the Auth0 Wordpress plugin configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications using the Auth0 WordPress Plugin with version
Fix Upgrade Auth0/wordpress plugin to v5.3.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.
Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.
CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Sources and references
- GitHub Advisory GHSA-2f4r-34m4-3w8q github.com
- github.com github.com
- nvd.nist.gov nvd.nist.gov
- github.com github.com
- github.com github.com
Critical Composer (PHP) advisories · Today’s Security Digest