CVE-2025-47275 Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
Attackers can brute force authentication tags in CookieStore sessions to gain unauthorized access to applications using the Auth0-PHP SDK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47275?
CVE-2025-47275 is a critical authentication bypass vulnerability in auth0-PHP, published on 15 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected.
Weakness: CWE-287
Which versions are affected by CVE-2025-47275?
2 open source packages ship an affected version, including auth0/auth0-php.
| Package | Affected | Fixed in |
|---|---|---|
auth0/auth0-php Packagist | From 8.0.0-BETA1 | 8.14.0 |
auth0/auth0-php Packagist | From 8.0.0-BETA1 | 8.14.0 |
How do I fix CVE-2025-47275?
Upgrade auth0/auth0-php to 8.14.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-47275 being exploited?
There is no known exploitation of CVE-2025-47275 in the wild and no public exploit code.
Sources
Also known as GHSA-g98g-r7gf-2r25.