Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-731m-xrcd-kud8
Vulnerability ID VCID-731m-xrcd-kud8
Aliases CVE-2025-47275
GHSA-g98g-r7gf-2r25
Summary Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Certain pre-conditions are required to be vulnerable to this issue: Applications using the Auth0-PHP SDK, or the Auth0/symfony, Auth0/laravel-auth0, and Auth0/wordpress SDKs that rely on the Auth0-PHP SDK; and session storage configured with CookieStore. Upgrade Auth0/Auth0-PHP to v8.14.0 to receive a patch. As an additional precautionary measure, rotating cookie encryption keys is recommended. Note that once updated, any previous session cookies will be rejected.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-287 Improper Authentication
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2025-47275
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2025-47275
epss 0.00084 https://api.first.org/data/v1/epss?cve=CVE-2025-47275
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-g98g-r7gf-2r25
cvssv3.1 9.1 https://github.com/auth0/auth0-PHP
generic_textual CRITICAL https://github.com/auth0/auth0-PHP
cvssv3.1 9.1 https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389
generic_textual CRITICAL https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389
ssvc Track https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389
cvssv3.1 9.1 https://github.com/auth0/auth0-PHP/releases/tag/8.14.0
generic_textual CRITICAL https://github.com/auth0/auth0-PHP/releases/tag/8.14.0
ssvc Track https://github.com/auth0/auth0-PHP/releases/tag/8.14.0
cvssv3.1 9.1 https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
cvssv3.1_qr CRITICAL https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
generic_textual CRITICAL https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
ssvc Track https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
cvssv3.1 9.1 https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3
generic_textual CRITICAL https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3
ssvc Track https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3
cvssv3.1 9.1 https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch
generic_textual CRITICAL https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch
ssvc Track https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch
cvssv3.1 9.1 https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q
generic_textual CRITICAL https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q
ssvc Track https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q
cvssv3.1 9.1 https://nvd.nist.gov/vuln/detail/CVE-2025-47275
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2025-47275
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-47275
https://github.com/auth0/auth0-PHP
https://nvd.nist.gov/vuln/detail/CVE-2025-47275
52a79480fdb246f59dbc089b81a784ae049bd389 https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389
8.14.0 https://github.com/auth0/auth0-PHP/releases/tag/8.14.0
GHSA-2f4r-34m4-3w8q https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q
GHSA-9fwj-9mjf-rhj3 https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3
GHSA-9wg9-93h9-j8ch https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch
GHSA-g98g-r7gf-2r25 https://github.com/advisories/GHSA-g98g-r7gf-2r25
GHSA-g98g-r7gf-2r25 https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/auth0/auth0-PHP
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-16T13:37:38Z/ Found at https://github.com/auth0/auth0-PHP/commit/52a79480fdb246f59dbc089b81a784ae049bd389
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/auth0/auth0-PHP/releases/tag/8.14.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-16T13:37:38Z/ Found at https://github.com/auth0/auth0-PHP/releases/tag/8.14.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-16T13:37:38Z/ Found at https://github.com/auth0/auth0-PHP/security/advisories/GHSA-g98g-r7gf-2r25
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-16T13:37:38Z/ Found at https://github.com/auth0/laravel-auth0/security/advisories/GHSA-9fwj-9mjf-rhj3
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-16T13:37:38Z/ Found at https://github.com/auth0/symfony/security/advisories/GHSA-9wg9-93h9-j8ch
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-05-16T13:37:38Z/ Found at https://github.com/auth0/wordpress/security/advisories/GHSA-2f4r-34m4-3w8q
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-47275
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.24399
EPSS Score 0.00084
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:13:58.455169+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/47xxx/CVE-2025-47275.json 38.6.0