AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaOKTA-04640PF

Insufficient Entropy in Cookie Encryption in Auth0 Symfony SDK

Okta

CVE-2026-34236 · Published Apr 1, 2026

High8.2
No fix yet
Okta advisory

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. To remediate, upgrade Auth0/symfony-auth0 to version 5.8.0 or greater.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 11Severity: Unrated to High
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Severity from
NVD

More Okta advisories

All Okta
Medium 6.5Jun 10Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDKCVE-2026-50157no fix yetHigh 7.1May 6Improper Permission Checking in Auth0.js SDKCVE-2026-42280no fix yetMedium 5.4Apr 17Improper Proxy Cache Lookup in the Auth0 Next.js SDKCVE-2026-40155no fix yetMedium 5.7Dec 10, 2025Improper Validation of Query Parameters in Auth0 Next.js SDKCVE-2025-67716no fix yetMedium 5.4Dec 10, 2025Improper Request Caching Lookup in the Auth0 Next.js SDKCVE-2025-67490no fix yetMedium 5.3Dec 10, 2025Improper Memory Cleanup in the Okta Java SDKCVE-2025-66033no fix yet