{"action":"Upgrade auth0/symfony to 5.9.0 or later.","affected":[{"fixed":"5.9.0","introduced":"5.0.0-BETA0"}],"component":"auth0/symfony","cve_ids":["CVE-2026-50157"],"ecosystem":"Packagist","epss":0.00506,"exploited":false,"fixed_versions":["5.9.0"],"ghsa_id":"GHSA-ffq7-hh2j-r24p","id":"tcs_01M5KF1RMT32A3ZFP5NQM8C0BZ","modified_at":"2026-07-28T05:30:29.612714243Z","published_at":"2026-07-14T19:31:23Z","references":["https://osv.dev/vulnerability/GHSA-ffq7-hh2j-r24p","https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p","https://github.com/auth0/symfony/commit/172d1d3e0b9d1e93610d786118389a811179bc8a","https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a","https://github.com/auth0/symfony","https://github.com/auth0/symfony/releases/tag/5.9.0"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-ffq7-hh2j-r24p","url":"https://osv.dev/vulnerability/GHSA-ffq7-hh2j-r24p"}],"summary":"Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter"}