CVE-2026-50157: Auth0 Symfony SDK Accepts Bearer Tokens via URL Query Parameter
Summary
CVE-2026-50157: Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter. Affects auth0/symfony versions >= 5.0.0-BETA0, < 5.9.0. Fixed in 5.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Auth0 Symfony SDK is a library that integrates Auth0's authentication services into Symfony applications, allowing developers to secure their applications with OAuth 2.0. It provides functionalities for user authentication, authorization, and session management. However, a vulnerability exists where the SDK can accept bearer tokens through URL query parameters, which poses a security risk.
Vulnerability Detail
The vulnerability arises from the Auth0 Symfony SDK's Authorizer security authenticator, which inadvertently accepts OAuth 2.0 bearer access tokens via URL query parameters in addition to the standard Authorization header. This behavior increases the risk of access token exposure and replay attacks against protected API endpoints, potentially allowing unauthorized access to sensitive resources.
How To Fix
Minimum fixed version
5.9.0
This is the first release that contains the fix.
composer require auth0/symfony:5.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid passing bearer tokens through URL query parameters. Instead, always use the Authorization header to transmit access tokens securely.
Conclusion
The Auth0 Symfony SDK vulnerability (CVE-2026-50157) allows bearer tokens to be accepted via URL query parameters, increasing the risk of unauthorized access. It is crucial to upgrade to version 5.9.0 or greater to mitigate this risk. Additionally, using Vulert can help monitor and manage vulnerabilities in your open-source dependencies.
See every vulnerability recorded for auth0/symfony →
FAQ
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to gain unauthorized access to protected API endpoints, leading to data breaches or unauthorized actions within the application.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software by analyzing your composer.lock file.
If an immediate upgrade is not possible, ensure that bearer tokens are not passed through URL query parameters and only use the Authorization header for token transmission.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/symfony.
