Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseGHSA-9wg9-93h9-j8ch
GHSA-9wg9-93h9-j8ch:
PHP vulnerability analysis and mitigation
Overview
The Auth0 Symfony SDK vulnerability (GHSA-9wg9-93h9-j8ch/CVE-2025-47275) affects applications using Auth0-PHP SDK versions between 8.0.0-BETA1 and prior to 8.14.0 that are configured with CookieStore. The vulnerability was discovered by Félix Charette and disclosed on May 15, 2025. The issue specifically impacts session cookies of applications using the Auth0 Symfony SDK (versions <=5.3.1) where authentication tags can be brute forced (GitHub Advisory).
Technical details
The vulnerability has been assigned a Critical severity rating with a CVSS v3.1 base score of 9.1. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges or user interaction, and can result in high impacts to both confidentiality and integrity. The vulnerability is classified under CWE-287 (Improper Authentication) (GitHub Advisory).
Impact
The vulnerability could result in unauthorized access to affected applications. The high CVSS scores for both confidentiality and integrity (H) indicate that attackers could potentially gain access to sensitive information and modify data within the application scope (GitHub Advisory).
Mitigation and workarounds
Users are advised to upgrade Auth0/symfony to version 5.4.0 to address the vulnerability. Additionally, it is recommended to rotate cookie encryption keys as a precautionary measure. It should be noted that after updating, any previous session cookies will be rejected (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management