CVE-2026-50157— Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
Quick assessment
Affected
auth0 symfony
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Auth0 Symfony 是用于 Auth0 身份验证和管理 API 的 Symfony SDK。在 5.0.0-BETA0 到 5.9.0 版本中， 安全认证器中的 和 方法可能会接受来自查询参数中 token URL 的 OAuth 2.0 Bearer 访问令牌，同时也接受来自 Authorization 请求头的令牌，用于受保护的 HTTP 路由。通过查询字符串传递的令牌可能会记录在服务器日志、浏览器历史记录或 Referrer（来源页）数据中，随后可能被重放攻击（replay）用于访问受保护的 API
Possible ATT&CK Techniques 1 AI
T1040 · Network Sniffing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-50157
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
Source: CVE Program / CVE List V5
Vulnerability Description
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过GET请求中的查询字符串导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-50157
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50157
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-50157 (1)
Vendor Advisories for CVE-2026-50157 (1)
Vendor Pages for CVE-2026-50157 (1)
-
🔗 Release 5.9.0 · auth0/symfony · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: symfony
-
CVE-2026-48761
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attr -
CVE-2026-48747
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algor -
CVE-2026-48489
Symfony: Security Firewall Bypass via failure_forward Subreq -
CVE-2026-48760
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: -
CVE-2026-48736
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Form
Same vendor: auth0
-
CVE-2026-84685
Improper Cache Isolation in auth0/react-native-auth0 SDK Web -
CVE-2026-85983
Local Privilege Escalation in Auth0 AD/LDAP Connector -
CVE-2026-85982
Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector -
CVE-2026-85981
Unauthenticated Localhost Admin Panel in Auth0 AD/LDAP Conne -
CVE-2026-42280
Improper Permission Checking in Auth.js SDK
Same weakness: CWE-598
-
CVE-2026-88897
Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Qu -
CVE-2026-61614
SolidInvoice's long-lived API tokens accepted as URL query p -
CVE-2026-82181
Le-yan｜Medical Practice Management System - Sensitive Data i -
CVE-2026-76179
Ebyte NA111-M Use of GET Request Method With Sensitive Query -
CVE-2026-63408
Grav API Plugin: JWT Access Token Accepted via `?token=` URL
V. Comments for CVE-2026-50157
No comments yet