~ / search / GHSA-ffq7-hh2j-r24p

GHSA-ffq7-hh2j-r24p

Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-50157

Packages

EcosystemPackageAffectedFixed in
Packagist auth0/symfony >= 5.0.0-BETA0, < 5.9.0 5.9.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Description Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access token exposure and replay against protected API endpoints. ### Resolution Upgrade auth0/symfony to version 5.9.0 or greater. ### Acknowledgement Okta would like to thank Alex Yeara for their discovery.

References

External links from the advisory. They lead to third-party sites.