GHSA-c42h-56wx-h85q laravel-auth0 SDK Deserialization of Untrusted Data vulnerability
Attackers can execute arbitrary code by sending malicious serialized data in cookies to applications using the vulnerable Laravel Auth0 SDK.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-c42h-56wx-h85q?
GHSA-c42h-56wx-h85q is an unsafe deserialization vulnerability in auth0/login, published on 6 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
- Applications using laravel-auth0 SDK, versions between 7.0.0-BETA1 to 7.2.1.
- Laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.
Fix Upgrade Auth0/laravel-auth0 to the latest version (v7.17.0).
Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.
Which versions are affected by GHSA-c42h-56wx-h85q?
2 open source packages ship an affected version, including auth0/login.
| Package | Affected | Fixed in |
|---|---|---|
auth0/login Packagist | From 7.0.0-BETA1 | 7.2.2 |
auth0/login Packagist | From 7.0.0-BETA1 | 7.2.2 |
How do I fix GHSA-c42h-56wx-h85q?
Upgrade auth0/login to 7.2.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is GHSA-c42h-56wx-h85q being exploited?
There is no known exploitation of GHSA-c42h-56wx-h85q in the wild and no public exploit code.