Advisoriesby IbisOktaOKTA-02JA0JI
Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
No fix yet
Applications built with the Auth0 Symphony SDK, using the Authorizer security authenticator to protect HTTP routes may accept OAuth 2.0 bearer access tokens provided through a URL query parameter, in addition to the standard Authorization header, which may increase the risk of access token exposure and replay against protected API endpoints. To remediate, upgrade auth0/symfony to version 5.9.0 or greater.
Affected versions
The source does not list versions here. See the source advisory for affected products and fixes.
Changes since it was listed
Severity: Unrated to Medium
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- NVD