erroneo.us
Search all guides⌘K

Security Digest · Critical advisory (no CVE assigned)

GHSA-98j6-67v3-mw34: Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data.

CVSS 9.3 Critical GitHub-reviewed · critical

Published By erroneo.us Security DeskSeen in the digest for Jun 5, 2025

Should you act?

  • Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with composer audit.
  • No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

EcosystemPackageVulnerableFirst fixed
Composer (PHP)auth0/symfony>= 5.0.0-BETA0, <= 5.0.05.1.0

Details

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

1. Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0. 2. Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade Auth0/symfony to the latest version (v5.4.0).

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

CVSS: 9.3 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Sources and references

  1. GitHub Advisory GHSA-98j6-67v3-mw34 github.com
  2. github.com github.com
  3. github.com github.com
  4. github.com github.com
  5. github.com github.com
  6. nvd.nist.gov nvd.nist.gov

Critical Composer (PHP) advisories · Today’s Security Digest