AUTH0 Symfony vulnerabilities

2 CVEs affecting AUTH0 Symfony, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-50157, published 2026-09-14.

More from AUTH0.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-50157, published 2026-09-14. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security…
• CVE-2025-68129, published 2025-12-17. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper…