p PatchFirst

GHSA-vfpx-q664-h93m

GHSA-vfpx-q664-h93m · Auth0 WordPress Plugin has Insufficient Entropy in Cookie Encryption

This page contains facts from public vulnerability sources. Check the original advisory before updating.

### Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. ### Am I Affected? Consumers are affected if their application meets the following preconditions: - It is using the Auth0 WordPress Plugin, versions between 5.0.0-BETA0 and 5.5.0 - Auth0 WordPress plugin using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0. ### Resolution Upgrade Auth0/wordpress to version 5.6.0 or greater.

CVSS 8.2 · High · Fix available

Published
Updated

Stack: php

Affected products and versions

  • auth0/wordpress Packagist

    Versions
    • 5.0.0
    • 5.0.0-BETA0
    • 5.0.0-BETA1
    • 5.0.1
    • 5.1.0
    • 5.2.0
    • 5.2.1
    • 5.3.0
    • 5.4.0
    • 5.5.0
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0-BETA0, < 5.6.0

    Update to 5.6.0

Original sources

Check your server →