auth0/symfony vulnerabilities

Latest auth0/symfony CVEs

Newest publication first

1. CVE-2026-50157 Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

   Published 2026-09-14

   Medium·CVSS 6.5 EPSS 0.51%

   Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query p...

2. GHSA-ghc5-95c2-vwcv Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption

   Published 2026-04-03

   High·CVSS 8.2

   Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. Am I Affected? Consumers are affected if their application meets the following pre...

3. CVE-2025-68129 Auth0-PHP SDK has Improper Audience Validation

   Published 2025-12-17

   High·CVSS 7.5 EPSS 0.42%

   Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Projects ar...

4. GHSA-f3r2-88mq-9v4g Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK

   Published 2025-12-17

   Medium·CVSS 6.8

   Description In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. Affected product and versions Projects are affected if they meet the...

5. GHSA-7jp2-5h22-m432 Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

   Published 2025-10-01

   Low·CVSS 3.3

   Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected? You are affected by this vulnerability i...

6. GHSA-98j6-67v3-mw34 Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

   Published 2025-06-06

   Critical·CVSS 9.3

   Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data...

7. GHSA-9wg9-93h9-j8ch Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

   Published 2025-05-17

   Critical·CVSS 9.1

   Overview Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. Am I Affected? You are affected by this vulnerability if you meet the following pre-conditi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.