CVE-2026-34236: Auth0 PHP SDK Insufficient Entropy in Cookie Encryption

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-01 · updated 2026-10-26
Weakness: CWE-331

Description

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. From version 8.0.0 to before version 8.19.0, in applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. This issue has been patched in version 8.19.0.

Affected products

auth0-PHP: from 8.0.0 before 8.19.0 — fixed in 8.19.0

How to fix

Upgrade to a fixed version: auth0-PHP 8.19.0. Check the vendor advisory for mitigations.

References

https://github.com/auth0/auth0-PHP/releases/tag/8.19.0
https://github.com/auth0/auth0-PHP/security/advisories/GHSA-w3wc-44p4-m4j7

Get alerted when CVE-2026-34236 or the next vulnerability affects your stack