GitHub Advisoryadvisory · Packagist

GHSA-ffq7-hh2j-r24p Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter

MEDIUM Published 2026-07-14 Modified 2026-07-14 Official page ↗
Aliases
CVE-2026-50157
Ecosystem
Packagist
Packages
auth0/symfony
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-598
Reviewed
2026-07-14

Affected packages

• Packagist auth0/symfony: >= 5.0.0-BETA0, < 5.9.0 → fixed in 5.9.0

Description

Description Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access token exposure and replay against protected API endpoints. Resolution Upgrade auth0/symfony to version 5.9.0 or greater. Acknowledgement Okta would like to thank Alex Yeara for their discovery.

Related

Alias · CVE (1)

  • CVE-2026-50157 Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-598 Use of HTTP Request With Sensitive Query String weakness

References