AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

OktaOKTA-0673W3B

Deserialization of Untrusted Data in Auth0-PHP SDK

Okta

CVE-2025-48951 · Published Jun 3, 2025

Critical9.3
No fix yet
Okta advisory

The Auth0 PHP SDK contains a vulnerability due to insecure deserialization of cookie data. Upgrade Auth0/Auth0-PHP to version 8.14.0.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 12Severity: Unrated to Critical
Details and references
CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from
NVD

More Okta advisories

All Okta
Medium 6.8Jul 22, 2025Okta On-Premises Provisioning (OPP) Password Reset Information DisclosureCVE-2025-7371no fix yetHigh 7.7Jun 3, 2025CDN Caching of Session Cookies in NextJS-Auth0 SDKCVE-2025-48947no fix yetCritical 9.1May 15, 2025Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDKCVE-2025-47275no fix yetHigh 8.6May 6, 2025SAML Attribute Smuggling Vulnerability Allowing User Impersonation in Passport-WS-FedCVE-2025-46573no fix yetCritical 9.3May 6, 2025SAML Signature Wrapping Vulnerability Leading to User Impersonation in Passport-WS-FedCVE-2025-46572no fix yetMedium 6.9Apr 30, 2025JWT Invalid Signature Validation in Auth0 Account Linking ExtensionsCVE-2025-46345no fix yet