Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
Affects Symfony HttpClient scoped clients built with a base_uri and default-scope options such as auth_bearer, in versions before 5.4.56, 6.4.50, 7.4.23 and 8.1.11. Fixed in those releases.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 5.4.56, 6.4.50, 7.4.23, 8.1.11
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 5.4.56, 6.4.50, 7.4.23, 8.1.11.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure17/25No login or user action needed, reachable over the network without a login · Data gap: Advisories don't say whether default setups are affected
- Reach10/20Affects Packagist packages
- Severity8.2/10CVSS 8.2
- No patch0/5No signal
What would change the score
- Would score about 80 if added to CISA KEV
- Would score about 75 if CISA's SSVC rates exploitation active
- Would score about 40 if advisories confirm default setups are exposed
CVE-2026-121971 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects symfony; fixed in 5.4.56, 6.4.50, 7.4.23 and 1 more.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 35/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 5.4.56, 6.4.50, 7.4.23, 8.1.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Symfony's HttpClient component, in its ScopingHttpClient, can send credentials from a default scope such as auth_bearer or auth_basic to a server on a different origin, which may expose those credentials to an attacker-controlled server. An attacker can reach this remotely, without logging in, by supplying a network-path URL such as "//evil.example/steal" when the client is built with a base_uri and credentials.
Read the original description
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together with the default scope’s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server. This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host. This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.http_client.scoped_clients. To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.
What to do
Upgrade to a fixed version: 5.4.56, 6.4.50, 7.4.23, 8.1.11.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- symfony/http-clientPackagist
fixed in 5.4.56; From 6.0.0 · fixed in 6.4.50; From 7.0.0 · fixed in 7.4.23; From 8.0.0 · fixed in 8.1.11
Evidence 2
- Advisory
- Patch
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-121971
Is CVE-2026-121971 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A network-path URL such as //evil.example/steal is sent to another host together with the default scope's credentials, which include the bearer token, basic auth, headers and client certificate. This discloses those credentials to that host.Source: github.com
Which versions are affected by CVE-2026-121971?
symfony/http-client (Packagist): before 5.4.56; from 6.0.0 before 6.4.50; from 7.0.0 before 7.4.23; from 8.0.0 before 8.1.11.Source: cve.now feed data
Am I affected, and how do I check?
Affected versions are Symfony before 5.4.56, 6.0.0 before 6.4.50, 7.0.0 before 7.4.23, and 8.0.0 before 8.1.11. The setup is a client created by HttpClient::createForBaseUri() or configured with a base_uri under framework.http_client.scoped_clients, along with default-scope options such as auth_bearer. Check the installed version with composer show symfony/http-client or in composer.lock.Source: github.com
How do I fix CVE-2026-121971?
Upgrade to 5.4.56, 6.4.50, 7.4.23 or 8.1.11, whichever matches the installed release line.Source: github.com