---
title: "GHSA-9fwj-9mjf-rhj3: laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions"
url: https://erroneo.us/security/ghsa/GHSA-9fwj-9mjf-rhj3/
description: "GHSA-9fwj-9mjf-rhj3 (critical, Composer (PHP)): laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions. Overview Session…"
type: advisory
section: "Security Digest"
date_published: 2025-05-17
date_modified: 2025-05-17
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-9fwj-9mjf-rhj3"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-9fwj-9mjf-rhj3: laravel-auth0 SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

## Affected packages

- Composer (PHP) `auth0/login` < 7.17.0 → fixed: 7.17.0

## Details

Overview Session cookies of applications using the laravel-auth0 SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications using laravel-auth0 SDK with version

## Sources

- [GitHub Advisory GHSA-9fwj-9mjf-rhj3](https://github.com/advisories/GHSA-9fwj-9mjf-rhj3)
- [github.com](https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3)
- [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-47275)
- [github.com](https://github.com/auth0/laravel-auth0/commit/be2c59adb476c49945dcc55741a54c7a68c1741d)
- [github.com](https://github.com/auth0/laravel-auth0/releases/tag/7.17.0)

---
Source page: https://erroneo.us/security/ghsa/GHSA-9fwj-9mjf-rhj3/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt