MAL-2025-19306 Malicious code in elara-loglevel-cressida-auth0 (npm)

The package elara-loglevel-cressida-auth0 was found to contain malicious code...

MAL-2025-20049 Malicious code in exoplanet-hexo-sagitta-auth0 (npm)

The package exoplanet-hexo-sagitta-auth0 was found to contain malicious code...

MAL-2025-28033 Malicious code in oberon-css-loader-neptunology-auth0 (npm)

The package oberon-css-loader-neptunology-auth0 was found to contain malicious code...

MAL-2025-25664 Malicious code in luna-got-auth0-yildun (npm)

The package luna-got-auth0-yildun was found to contain malicious code...

Malicious code in auth0-base (npm)

The package auth0-base was found to contain malicious code...

MAL-2025-25595 Malicious code in loopback-gammarayburst-boson-auth0 (npm)

The package loopback-gammarayburst-boson-auth0 was found to contain malicious code...

MAL-2025-18456 Malicious code in dione-blitz-indus-auth0 (npm)

The package dione-blitz-indus-auth0 was found to contain malicious code...

MAL-2025-25903 Malicious code in mantle-paleoceanography-mira-auth0 (npm)

The package mantle-paleoceanography-mira-auth0 was found to contain malicious code...

Malware in auth0-app

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in auth0-styleguide-website

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in auth0-styleguide-website (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac62aa1f1cbfe11927a1bc4a54326be2b214f65a0d101d475bf45c44b0d96f4 Any computer that has this package installed or running should be considered...

MAL-2025-5632 Malicious code in auth0-styleguide-website (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac62aa1f1cbfe11927a1bc4a54326be2b214f65a0d101d475bf45c44b0d96f4 Any computer that has this package installed or running should be considered...

Malicious code in auth0-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bb8364e4a661d732190dea931ee1bd3aedea3c1005b1daa41507601bb281443 Any computer that has this package installed or running should be considered...

MAL-2025-5615 Malicious code in auth0-app (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bb8364e4a661d732190dea931ee1bd3aedea3c1005b1daa41507601bb281443 Any computer that has this package installed or running should be considered...

CVE-2025-48947

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In Auth0 Next.js SDK versions 4.0.1 through 4.6.0, session cookies set by auth0.middleware may be cached by CDNs due to missing Cache-Control headers. Three preconditions must be met in order for...

GHSA-C42H-56WX-H85Q laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

Overview The laravel-auth0 SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

GHSA-98J6-67V3-MW34 Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data. Am I Affected?...

CVE-2025-48951

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. Versions 8.0.0-BETA3 prior to 8.3.1 contain a vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially...