Is CVE-2026-50157 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50157 being exploited in the wild.

How severe is CVE-2026-50157?

Medium severity, with a CVSS score of 6.5, published 14 September 2026.

Which products and versions are affected?

Auth0 Symfony SDK >= 5.0.0-BETA0, = 5.0.0-BETA0, <= 5.8.0, ECOSYSTEM:introduced=5.0.0-BETA0,fixed=5.9.0.

Is there a fix for CVE-2026-50157?

Yes. auth0/symfony (Packagist): upgrade to 5.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50157 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-50157?

Check whether you run Auth0 Symfony SDK or auth0/symfony (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50157: Auth0 Symfony SDK sensitive information exposure via URL query parameters

Q: Is there a fix for CVE-2026-50157?

Yes. auth0/symfony (Packagist): upgrade to 5.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50157 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-50157?

Check whether you run Auth0 Symfony SDK or auth0/symfony (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50157 · Severity: medium · CVSS 6.5 · Published 2026-09-14

The Auth0 SDK for Symfony, which helps developers integrate authentication into their web applications, was found to incorrectly accept security tokens via URL web addresses. This is a security risk because tokens in URLs are often recorded in server logs, browser history, and shared links, which could allow an unauthorized person to steal a session and access protected data. Organizations using this library should update to the latest version to ensure tokens are only accepted through secure, standard headers.

Technologies: auth0/symfony (Packagist). Vendors: Auth0, Packagist.

Quick answers

Is CVE-2026-50157 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50157 being exploited in the wild.
How severe is CVE-2026-50157?: Medium severity, with a CVSS score of 6.5, published 14 September 2026.
Which products and versions are affected?: Auth0 Symfony SDK >= 5.0.0-BETA0, <= 5.8.0; auth0/symfony (Packagist) >= 5.0.0-BETA0, <= 5.8.0, ECOSYSTEM:introduced=5.0.0-BETA0,fixed=5.9.0.
Is there a fix for CVE-2026-50157?: Yes. auth0/symfony (Packagist): upgrade to 5.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50157 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-50157?: Check whether you run Auth0 Symfony SDK or auth0/symfony (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

auth0/symfony (Packagist): upgrade to 5.9.0 or later
```
composer require auth0/symfony:^5.9.0
```

Technical details

A vulnerability exists in the Auth0 Symfony SDK's Authorizer security authenticator where OAuth 2.0 bearer access tokens are accepted via the 'token' URL query parameter in addition to the standard Authorization header. This behavior violates RFC 6750 Section 2.3 and leads to sensitive information exposure (CWE-200, CWE-598). An attacker who gains access to server logs, browser history, or Referer headers could retrieve these tokens to replay requests against protected API endpoints. The fix, introduced in version 5.9.0, restricts token acceptance to the Authorization header only.

Affected products

Auth0 Auth0 Symfony SDK >= 5.0.0-BETA0, <= 5.8.0

Identifiers

CVE-2026-50157
GHSA-ffq7-hh2j-r24p

Timeline

2026-06-10: patched: Version 5.9.0 released
2026-07-14: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.