laravel-auth0 SDK Deserialization of Untrusted Data vulnerability
Impact
Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 7.0.0-BETA1 before 7.2.2Ecosystem versions | 7.2.2 |
Version evidence: OSV · GHSA-c42h-56wx-h85q
View original version evidence (7 explicit versions)
Original source description
Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
Am I Affected? You are affected by this vulnerability if you meet the following preconditions:
- Applications using laravel-auth0 SDK, versions between 7.0.0-BETA1 to 7.2.1.
- Laravel-auth0 SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.
Fix Upgrade Auth0/laravel-auth0 to the latest version (v7.17.0).
Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.
References
- Security advisory github.com/auth0/auth0-PHP/security/advisories/GHSA-v9m8-9xxp-q492
- Security advisory github.com/auth0/laravel-auth0/security/advisories/GHSA-c42h-56wx-h85q
- Security advisory github.com/auth0/symfony/security/advisories/GHSA-98j6-67v3-mw34
- Security advisory github.com/auth0/wordpress/security/advisories/GHSA-862m-5253-832r
- Security advisory nvd.nist.gov/vuln/detail/CVE-2025-48951
- Source reference github.com/auth0/laravel-auth0