Security Digest · Critical advisory (no CVE assigned)
GHSA-9wg9-93h9-j8ch: Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Overview Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | auth0/symfony | < 5.4.0 | 5.4.0 |
Details
Overview Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications using the Auth0 symfony SDK with version
Fix Upgrade Auth0/symfony to v5.4.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that once updated, any previous session cookies will be rejected.
Acknowledgement Okta would like to thank Félix Charette for discovering this vulnerability.
CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Sources and references
- GitHub Advisory GHSA-9wg9-93h9-j8ch github.com
- github.com github.com
- nvd.nist.gov nvd.nist.gov
- github.com github.com
- github.com github.com
Critical Composer (PHP) advisories · Today’s Security Digest