N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48951

CVE-2025-48951: Auth0-PHP SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

Applications using the Auth0-PHP SDK, versions between 8.0.0-BETA3 to 8.3.0.
Applications using the following SDKs that rely on the Auth0-PHP SDK versions between 8.0.0-BETA3 to 8.3.0: a. Auth0/symfony, b. Auth0/laravel-auth0, c. Auth0/wordpress.

Fix Upgrade Auth0/Auth0-PHP to 8.3.1.

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48951

CVE-2025-48951:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
auth0/auth0-php	composer	>= 8.0.0-BETA3, < 8.3.1	8.3.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-48951 / GHSA-v9m8-9xxp-q492) is a Deserialization of Untrusted Data (CWE-502) in the Auth0-PHP SDK, specifically within the CookieStore class. The root cause was the use of PHP's unserialize() function in the Auth0\SDK\Store\CookieStore::decrypt() method. This method was tasked with processing data read from cookies.

The Auth0\SDK\Store\CookieStore::getState() method is responsible for fetching raw cookie data from the $_COOKIE superglobal. It would concatenate relevant cookie parts and then pass this combined string to the decrypt() method.

Inside decrypt(), before the patch, this cookie-derived string was subjected to unserialize() at multiple points: once to parse an outer structure (if encrypted, this structure contained elements like an initialization vector, a tag, and the encrypted data itself) and again to deserialize the core data payload (either after decryption or directly if encryption was not used).

An attacker could craft a malicious cookie containing a specially serialized PHP object. When getState() read this cookie and passed its content to decrypt(), the unserialize() calls would then attempt to instantiate this malicious object. If a suitable PHP class (a "gadget") was available in the application's class path that could be misused upon deserialization (e.g., via magic methods like __wakeup() or __destruct()), this could lead to various impacts, including remote code execution, data exposure, or denial of service.

The patch addressed this by completely removing the usage of serialize() and unserialize(). Instead, json_encode() is now used for preparing data for cookie storage (in the encrypt method, which was also modified) and json_decode() (with true for associative arrays) is used in the decrypt() method for safely parsing the cookie data. Additionally, setrawcookie() is used instead of setcookie() to prevent unintended URL encoding/decoding issues with the cookie values. This ensures that only simple data structures are processed, mitigating the risk of object injection.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.