CyberRota Analysis
AI-GeneratedThe Auth0 Symfony SDK versions 5.0.0-BETA0 to 5.9.0 are vulnerable due to the Authorizer::authenticate() and Authorizer::supports() methods accepting OAuth 2.0 bearer tokens from both the Authorization header and the token URL query parameter. This can lead to sensitive tokens being logged or exposed, allowing attackers to potentially replay them against protected API endpoints. Organizations using affected versions of the Auth0 Symfony SDK should prioritize upgrading to version 5.9.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.