---
title: "GHSA-9wg9-93h9-j8ch: Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions"
url: https://erroneo.us/security/ghsa/GHSA-9wg9-93h9-j8ch/
description: "GHSA-9wg9-93h9-j8ch (critical, Composer (PHP)): Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions. Overview Session…"
type: advisory
section: "Security Digest"
date_published: 2025-05-17
date_modified: 2025-05-17
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-9wg9-93h9-j8ch"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-9wg9-93h9-j8ch: Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

## Affected packages

- Composer (PHP) `auth0/symfony` < 5.4.0 → fixed: 5.4.0

## Details

Overview Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditions: 1. Applications using the Auth0 symfony SDK with version

## Sources

- [GitHub Advisory GHSA-9wg9-93h9-j8ch](https://github.com/advisories/GHSA-9wg9-93h9-j8ch)
- [github.com](https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch)
- [nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-47275)
- [github.com](https://github.com/auth0/symfony/commit/9a7294f08a32f17a0e77c8522a648195b6940340)
- [github.com](https://github.com/auth0/symfony/releases/tag/5.4.0)

---
Source page: https://erroneo.us/security/ghsa/GHSA-9wg9-93h9-j8ch/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt