Résumé
Auth0 Symfony SDK Accepted Bearer Tokens via URL Query Parameter
Détails de l’avis
Description
Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access token exposure and replay against protected API endpoints.
Resolution
Upgrade auth0/symfony to version 5.9.0 or greater.
Acknowledgement
Okta would like to thank Alex Yeara for their discovery.
Références
- https://github.com/advisories/GHSA-ffq7-hh2j-r24p
- https://github.com/auth0/symfony/security/advisories/GHSA-ffq7-hh2j-r24p
- https://github.com/auth0/symfony/commit/172d1d3e0b9d1e93610d786118389a811179bc8a
- https://github.com/auth0/symfony/commit/bd1851b14ae15e99cbe87c96496cf25da025288a
- https://github.com/auth0/symfony/releases/tag/5.9.0
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-75912
CodeWhale: Argument Injection in `git_blame` Tool Allows Arbitrary File Read Without Approval
- HIGHCVE-2026-75915
CodeWhale: js_execution leaks parent environment to model context via missing env scrub
- HIGHCVE-2026-75859
CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository
- HIGHCVE-2026-72804
SiYuan: Graph endpoints omit the publish-password tier: anonymous readers receive block-level content of password-protected documents
- MEDIUMCVE-2026-61842
Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)
- MEDIUMCVE-2026-73229
Django REST framework: AdminRenderer may disclose GET-protected data when rendering invalid write requests