Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK CVE-2026-50157 - Jun 10, 2026
Overview
Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access token exposure and replay against protected API endpoints.
Affected versions
>= 5.0.0-BETA0, <= 5.8.0
Resolution
Upgrade auth0/symfony to version 5.9.0 or greater.
Acknowledgement
Okta would like to thank Alex Yeara for their discovery.
CVE details
CVE ID | CVE-2026-50157 |
Published Date | 2026-06-10 |
Vulnerability Type | Improper Bearer Token Transmission |
CWE | CWE-598 - Use of GET Request Method with Sensitive Query String |
CVSS v3 | Score: 6.5 Vector string: https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
References
Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK