High severity8.2NVD Advisory· Published Apr 1, 2026· Updated Apr 7, 2026
CVE-2026-34236
CVE-2026-34236
Description
Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
auth0/auth0-phpPackagist | >= 8.0.0, < 8.19.0 | 8.19.0 |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-w3wc-44p4-m4j7ghsaADVISORY
- github.com/auth0/auth0-PHP/security/advisories/GHSA-w3wc-44p4-m4j7nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-34236ghsaADVISORY
- github.com/auth0/auth0-PHP/releases/tag/8.19.0nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.