https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T20:52:22.656722+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-50157 fkie_cve-2026-50157 2026-09-28T20:52:22.658199+00:00

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.

 https://db.gcve.eu/vuln/ghsa-ffq7-hh2j-r24p GHSA-ffq7-hh2j-r24p — Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter 2026-09-28T20:52:22.658325+00:00

Affected: Packagist: auth0/symfony

### Description Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access token exposure and replay against protected API endpoints.

### Resolution Upgrade auth0/symfony to version 5.9.0 or greater.

### Acknowledgement Okta would like to thank Alex Yeara for their discovery.