Skip to content
OpenAdvisories

Package · Packagist

auth0/symfony

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 6.5
    CVE-2026-50157

    Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

    Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from …

    auth0 symfony auth0/symfony Packagist
  • High 8.2
    GHSA-ghc5-95c2-vwcv

    Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption

    ### Impact In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies. ### Am I Affected? Consumers are affected if their applic…

    auth0/symfony Packagist
  • Medium 6.8
    GHSA-f3r2-88mq-9v4g

    Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK

    ### Description In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens. ### Affected product and versions Projects …

    auth0/symfony Packagist
  • Low 3.3
    GHSA-7jp2-5h22-m432

    Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

    ### Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. ### Am I affected? You are aff…

    auth0/symfony Packagist
  • Critical —
    GHSA-98j6-67v3-mw34

    Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

    **Overview** The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing …

    auth0/symfony Packagist
  • Critical 9.1
    GHSA-9wg9-93h9-j8ch

    Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions

    **Overview** Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access. **Am I Affected?** You are affected by this vulnerability if you m…

    auth0/symfony Packagist