Malicious code in exoplanet-hexo-sagitta-auth0 (npm)

The package exoplanet-hexo-sagitta-auth0 was found to contain malicious code...

Malicious code in nextjs-cosmos-spinner-auth0 (npm)

The package nextjs-cosmos-spinner-auth0 was found to contain malicious code...

Malicious code in dione-blitz-indus-auth0 (npm)

The package dione-blitz-indus-auth0 was found to contain malicious code...

MAL-2025-26132 Malicious code in mechatronics-ophiuchus-loopback-auth0 (npm)

The package mechatronics-ophiuchus-loopback-auth0 was found to contain malicious code...

MAL-2025-19306 Malicious code in elara-loglevel-cressida-auth0 (npm)

The package elara-loglevel-cressida-auth0 was found to contain malicious code...

Malicious code in mechatronics-ophiuchus-loopback-auth0 (npm)

The package mechatronics-ophiuchus-loopback-auth0 was found to contain malicious code...

MAL-2025-15089 Malicious code in auth0-base (npm)

The package auth0-base was found to contain malicious code...

MAL-2025-27401 Malicious code in nextjs-cosmos-spinner-auth0 (npm)

The package nextjs-cosmos-spinner-auth0 was found to contain malicious code...

MAL-2025-18456 Malicious code in dione-blitz-indus-auth0 (npm)

The package dione-blitz-indus-auth0 was found to contain malicious code...

MAL-2025-5632 Malicious code in auth0-styleguide-website (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac62aa1f1cbfe11927a1bc4a54326be2b214f65a0d101d475bf45c44b0d96f4 Any computer that has this package installed or running should be considered...

Malicious code in auth0-styleguide-website (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac62aa1f1cbfe11927a1bc4a54326be2b214f65a0d101d475bf45c44b0d96f4 Any computer that has this package installed or running should be considered...

Malicious code in auth0-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bb8364e4a661d732190dea931ee1bd3aedea3c1005b1daa41507601bb281443 Any computer that has this package installed or running should be considered...

MAL-2025-5615 Malicious code in auth0-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bb8364e4a661d732190dea931ee1bd3aedea3c1005b1daa41507601bb281443 Any computer that has this package installed or running should be considered...

CVE-2025-48947

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for...

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

GHSA-C42H-56WX-H85Q laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

GHSA-98J6-67V3-MW34 Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

CVE-2025-48951

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially...

Deserialization Of Untrusted Data

auth0/auth0-php is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to insecure deserialization due to the SDK processing untrusted cookie data without authentication, allowing attackers to inject malicious serialized payloads...