CVE-2026-34236

Packagist/auth0/auth0-php CVE-2026-34236: high 8.2, EPSS 0.32%

Auth0 PHP SDK has Insufficient Entropy in Cookie Encryption

Action: Upgrade auth0/auth0-php to 8.19.0 or later.

composer require auth0/auth0-php:8.19.0

Affected

Fixed versions

Sources

• osv: GHSA-w3wc-44p4-m4j7
• https://github.com/auth0/auth0-PHP/security/advisories/GHSA-w3wc-44p4-m4j7
• https://nvd.nist.gov/vuln/detail/CVE-2026-34236
• https://github.com/auth0/auth0-PHP
• https://github.com/auth0/auth0-PHP/releases/tag/8.19.0

CVE-2026-34236 · published 2026-04-01T20:29:26Z · modified 2026-04-01T20:56:28.595224Z · JSON