erroneo.us
Search all guides⌘K

Security Digest · Critical advisory (no CVE assigned)

GHSA-c42h-56wx-h85q: laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data.

CVSS 9.3 Critical GitHub-reviewed · critical

Published By erroneo.us Security DeskSeen in the digest for Jun 6, 2025

Should you act?

  • Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with composer audit.
  • No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories. npm audit, pip-audit and Dependabot do read GitHub advisories.

Affected packages

EcosystemPackageVulnerableFirst fixed
Composer (PHP)auth0/login>= 7.0.0-BETA1, <= 7.2.17.2.2

Details

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

1. Applications using laravel-auth0 SDK, versions between 7.0.0-BETA1 to 7.2.1. 2. Laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade Auth0/laravel-auth0 to the latest version (v7.17.0).

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

CVSS: 9.3 (v4.0) CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Sources and references

  1. GitHub Advisory GHSA-c42h-56wx-h85q github.com
  2. github.com github.com
  3. github.com github.com
  4. github.com github.com
  5. github.com github.com
  6. nvd.nist.gov nvd.nist.gov

Critical Composer (PHP) advisories · Today’s Security Digest