-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability lies in the handling of session cookies within the Auth0-PHP SDK when configured with CookieStore. The provided commit 52a79480fdb246f59dbc089b81a784ae049bd389 directly addresses this by modifying the decrypt method in the CookieStore.php file. The patch introduces a strict validation for the length of the authentication tag. Before this change, the decrypt function did not perform this length check, making it susceptible to a brute-force attack on the authentication tag. If an attacker could guess or brute-force a valid tag, they could potentially decrypt the session cookie and gain unauthorized access. Therefore, the Auth0\SDK\Store\CookieStore::decrypt function is identified as the vulnerable function as it was responsible for processing the potentially forgeable encrypted session cookie without adequate validation of the authentication tag's length.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| auth0/auth0-php | composer | >= 8.0.0-BETA1, < 8.14.0 | 8.14.0 |
Ongoing coverage of React2Shell