GHSA-98j6-67v3-mw34 Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability
Attackers can execute arbitrary code by sending malicious serialized data in cookies to applications using the Auth0 Symfony SDK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-98j6-67v3-mw34?
GHSA-98j6-67v3-mw34 is an unsafe deserialization vulnerability in auth0/symfony, published on 6 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
- Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0.
- Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.
Fix Upgrade Auth0/symfony to the latest version (v5.4.0).
Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.
Which versions are affected by GHSA-98j6-67v3-mw34?
2 open source packages ship an affected version, including auth0/symfony.
| Package | Affected | Fixed in |
|---|---|---|
auth0/symfony Packagist | From 5.0.0-BETA0 | 5.1.0 |
auth0/symfony Packagist | From 5.0.0-BETA0 | 5.1.0 |
How do I fix GHSA-98j6-67v3-mw34?
Upgrade auth0/symfony to 5.1.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-98j6-67v3-mw34 being exploited?
There is no known exploitation of GHSA-98j6-67v3-mw34 in the wild and no public exploit code.