# CVE-2026-50157: Auth0 Symfony SDK sensitive information exposure via URL query parameters

Source: https://junglewise.ai/threats/cve-2026-50157-auth0-symfony-sdk-sensitive-information-exposure-via-url-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-50157 · Severity: medium · CVSS 6.5 · Published 2026-09-14

The Auth0 SDK for Symfony, which helps developers integrate authentication into their web applications, was found to incorrectly accept security tokens via URL web addresses. This is a security risk because tokens in URLs are often recorded in server logs, browser history, and shared links, which could allow an unauthorized person to steal a session and access protected data. Organizations using this library should update to the latest version to ensure tokens are only accepted through secure, standard headers.

Technologies: [auth0/symfony (Packagist)](https://junglewise.ai/threats/technologies/auth0-symfony). Vendors: [Auth0](https://junglewise.ai/threats/vendors/auth0), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-50157 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50157 being exploited in the wild.

**How severe is CVE-2026-50157?** Medium severity, with a CVSS score of 6.5, published 14 September 2026.

**Which products and versions are affected?** Auth0 Symfony SDK >= 5.0.0-BETA0, <= 5.8.0; auth0/symfony (Packagist) >= 5.0.0-BETA0, <= 5.8.0, ECOSYSTEM:introduced=5.0.0-BETA0,fixed=5.9.0.

**Is there a fix for CVE-2026-50157?** Yes. auth0/symfony (Packagist): upgrade to 5.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50157 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-50157?** Check whether you run Auth0 Symfony SDK or auth0/symfony (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- auth0/symfony (Packagist): upgrade to 5.9.0 or later

  ```sh
  composer require auth0/symfony:^5.9.0
  ```


## Technical details

A vulnerability exists in the Auth0 Symfony SDK's Authorizer security authenticator where OAuth 2.0 bearer access tokens are accepted via the 'token' URL query parameter in addition to the standard Authorization header. This behavior violates RFC 6750 Section 2.3 and leads to sensitive information exposure (CWE-200, CWE-598). An attacker who gains access to server logs, browser history, or Referer headers could retrieve these tokens to replay requests against protected API endpoints. The fix, introduced in version 5.9.0, restricts token acceptance to the Authorization header only.

## Affected products

- Auth0 Auth0 Symfony SDK >= 5.0.0-BETA0, <= 5.8.0

## Identifiers

- CVE-2026-50157
- GHSA-ffq7-hh2j-r24p

## Timeline

- 2026-06-10: patched: Version 5.9.0 released
- 2026-07-14: advisory: GitHub Advisory published

## References

- [https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p](https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p)
- [https://github.com/auth0/symfony/commit/172d1d3e0b9d1e93610d786118389a811179bc8a](https://github.com/auth0/symfony/commit/172d1d3e0b9d1e93610d786118389a811179bc8a)
- [https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a](https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a)
- [https://github.com/auth0/symfony/releases/tag/5.9.0](https://github.com/auth0/symfony/releases/tag/5.9.0)
- [https://api.github.com/repos/auth0/symfony/security-advisories/GHSA-ffq7-hh2j-r24p](https://api.github.com/repos/auth0/symfony/security-advisories/GHSA-ffq7-hh2j-r24p)

## Related threats

- [Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption](https://junglewise.ai/threats/auth0-symfony-sdk-has-insufficient-entropy-in-cookie-encryption-879e650c)
- [Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK](https://junglewise.ai/threats/auth0-symfony-sdk-has-improper-audience-validation-via-auth0-php-sdk-1672c32f)
- [Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import](https://junglewise.ai/threats/auth0-symfony-sdk-does-not-properly-handle-file-types-in-bulk-user-e11aaa8c)
- [Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability](https://junglewise.ai/threats/auth0-symfony-sdk-deserialization-of-untrusted-data-vulnerability-8935e08b)
- [Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions](https://junglewise.ai/threats/auth0-symfony-sdk-vulnerable-to-brute-force-authentication-tags-of-56db288e)