CVE-2026-50157: AUTH0 Symfony

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.

Affected products

• AUTH0 Symfony: from 5.0.0-BETA0, before 5.9.0 (fixed in 5.9.0)

Published 2026-09-14. Last modified 2026-09-30.