{"id":"GHSA-ffq7-hh2j-r24p","aliases":["CVE-2026-50157"],"title":"Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter","description":"### Description\nApplications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access token exposure and replay against protected API endpoints.\n\n### Resolution\nUpgrade auth0/symfony to version 5.9.0 or greater.\n\n### Acknowledgement\nOkta would like to thank Alex Yeara for their discovery.","severity":"medium","score":6.5,"published":"2026-07-14T19:31:23.000Z","modified":"2026-07-28T05:30:29.612Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"auth0/symfony","ranges":[{"events":[{"introduced":"5.0.0-BETA0"},{"fixed":"5.9.0"}],"type":"ECOSYSTEM"}],"versions":["5.0.0","5.0.0-BETA0","5.0.0-BETA1","5.1.0","5.2.0","5.2.1","5.2.2","5.2.3","5.3.0","5.3.1","5.4.0","5.4.1","5.5.0","5.6.0","5.7.0","5.8.0"],"fixed":["5.9.0"]}],"sourceAffected":[],"references":["https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p","https://github.com/auth0/symfony/commit/172d1d3e0b9d1e93610d786118389a811179bc8a","https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a","https://github.com/auth0/symfony","https://github.com/auth0/symfony/releases/tag/5.9.0"],"sources":[{"name":"OSV","id":"GHSA-ffq7-hh2j-r24p","modified":"2026-07-28T05:30:29.612714243Z","url":"https://osv.dev/vulnerability/GHSA-ffq7-hh2j-r24p"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5}]}