Unrated

Bearer token exposure via query parameter in Auth0 Symfony SDK Authorizer

IdentifiersCVE-2026-50157CWE-598

CVE-2026-50157 is an improper handling issue in the Auth0 Symfony SDK affecting deployments that use the Authorizer security authenticator to protect HTTP routes. In vulnerable versions, the authenticator may accept OAuth 2.0 bearer access tokens supplied in a URL query parameter rather than restricting token processing to the HTTP Authorization header. This behavior weakens the confidentiality expectations for bearer tokens because URLs are commonly recorded or propagated by application logs, browser history, referrer headers, reverse proxies, and other intermediaries. As a result, valid access tokens may be exposed and subsequently replayed against protected API endpoints.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

The primary impact is exposure of valid bearer access tokens through URL-handling mechanisms. If a token is captured from logs, browser artifacts, referrer data, monitoring systems, or intermediary infrastructure, an attacker may be able to replay that token to access protected routes as the token holder until the token expires or is revoked. This can result in unauthorized access to API resources and any actions permitted by the compromised token's scope and associated identity.

Mitigation

If you can’t patch tonight, do this now.

Until the fixed version can be deployed, avoid passing bearer access tokens in URL query parameters under any circumstance and ensure clients send tokens only in the Authorization header. Review application, proxy, and observability configurations to minimize URL logging and sanitize historical logs where feasible. Consider revoking and reissuing tokens that may have been exposed through query-string handling.

Remediation

Patch, then assume compromise.

Upgrade the auth0/symfony package to version 5.9.0 or later, which no longer permits this insecure token acceptance behavior for the affected authenticator path.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Auth0Symfonyapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity