CVE-2025-48951

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48951
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48951.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48951
Aliases
Related
GHSA (4)
Published
2025-06-03T20:52:35Z
Modified
2026-10-21T02:53:51Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
Auth0-PHP SDK Deserialization of Untrusted Data vulnerability
Details

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Applications using the Auth0-PHP SDK are affected, as are applications using the Auth0/symfony, Auth0/laravel-auth0, or Auth0/wordpress SDKs, because those SDKsrely on the Auth0-PHP SDK versions from 8.0.0-BETA3 until 8.14.0. Version 8.3.1 contains a patch for the issue.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-502"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48951.json"
}
References

Affected packages

Git / github.com/auth0/auth0-php

Affected ranges

Type
GIT
Repo
https://github.com/auth0/auth0-php
Events
Introduced
c0168fe385e18d8a2cd3980512142cc2449bea0b
Fixed
848c702e2ea58c8dba0cae30976953b5772f8bf0
Fixed
04b1f5daa8bdfebc5e740ec5ca0fb2df1648a715
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "8.0.0-BETA3"
                },
                {
                    "fixed":  "8.3.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "04b1f5daa8bdfebc5e740ec5ca0fb2df1648a715"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

8.*
8.0.0
8.0.0-BETA3
8.0.1
8.0.2
8.0.3
8.0.4
8.0.5
8.0.6
8.1.0
8.2.0
8.2.1
8.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48951.json"