GHSA-GHC5-95C2-VWCV: GHSA-GHC5-95C2-VWCV: Insufficient Entropy in Cookie Encryption within Auth0 Symfony SDK

GHSA-GHC5-95C2-VWCV: Insufficient Entropy in Cookie Encryption within Auth0 Symfony SDK Vulnerability ID: GHSA-GHC5-95C2-VWCV CVSS Score: 8.2 Published: 2026-04-03 The Auth0 Symfony SDK (versions 5.0.0 through 5.7.0) is vulnerable to an insufficient entropy flaw in its cookie encryption implementation, stemming from the underlying auth0/auth0-php library. This allows an attacker to brute-force session keys and forge valid authentication cookies. TL;DR Insufficient entropy in Auth0 Symfony SDK cookie encryption allows attackers to brute-force session keys and forge authentication cookies, leading to full account takeover. ⚠️ Exploit Status: POC Technical Details Vulnerability ID: GHSA-GHC5-95C2-VWCV Mapped CVE: CVE-2026-34236 CWE ID: CWE-331 (Insufficient Entropy) CVSS v3.1 Score: 8.2 (High) Attack Vector: Network Attack Complexity: High Primary Impact: Account Takeover via Session Forgery Affected Systems Auth0 Symfony SDK (auth0/symfony) Auth0 PHP SDK (auth0/auth0-php) Symfony Applica