CVE-2026-50157
Received Received - Intake

Authentication Bypass via OAuth Token in Auth0 Symfony SDK

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: GitHub, Inc.

Description
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-50157
EUVD
EUVD-2026-77672

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
auth0 symfony to 5.9.0 (inc)
auth0 symfony From 5.0.0-BETA0 (inc) to 5.8.0 (inc)
auth0 symfony 5.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses the HTTP GET method to process a request and includes sensitive information in the query string of that request.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Auth0 Symfony SDK versions 5.0.0-BETA0 to 5.8.0. It allows OAuth 2.0 bearer access tokens to be accepted not only via the standard Authorization header but also through a URL query parameter named 'token'. This practice is insecure because tokens in URLs can be exposed in server logs, browser history, or referrer data and then replayed against protected API endpoints.

Detection Guidance

Check if your Auth0 Symfony SDK version is between 5.0.0-BETA0 and 5.8.0. Inspect server logs for tokens passed via URL query parameters like 'token='. Review application code for Authorizer::authenticate() or Authorizer::supports() usage accepting tokens from query strings.

Impact Analysis

An attacker could exploit this to capture tokens from exposed URLs and reuse them to gain unauthorized access to protected API endpoints. This could lead to data breaches or unauthorized actions if the token has sufficient permissions. The impact includes potential confidentiality loss and unauthorized API access.

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive data, such as GDPR (data protection) and HIPAA (health information privacy). Token exposure through URLs could result in unauthorized access to personal or health data, leading to regulatory penalties or breaches of confidentiality obligations.

Mitigation Strategies

Upgrade the Auth0 Symfony SDK to version 5.9.0 or later. Ensure tokens are only accepted via the Authorization header, not URL query parameters. Review and update any code or configurations that allow token extraction from query strings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart