GHSA-fmg6-246m-9g2v: Auth0 laravel-auth0 SDK has Insufficient Entropy in Cookie Encryption

April 3, 2026

In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.

References

github.com/advisories/GHSA-fmg6-246m-9g2v
github.com/auth0/laravel-auth0
github.com/auth0/laravel-auth0/security/advisories/GHSA-fmg6-246m-9g2v

Code Behaviors & Features

Detect and mitigate GHSA-fmg6-246m-9g2v with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →