Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

symfony/security-http

21 known vulnerabilities (1 critical, 7 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
21 · 1 critical, 7 high, 3 medium, 1 low
Registry
Packagist

Advisories 21

  • Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

    Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.

  • Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)

    Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.

  • Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

    Affected: fixed in 5.4.53; from 6.0.0, fixed in 6.4.41; from 7.0.0, fixed in 7.4.13; from 8.0.0, fixed in 8.0.13.

  • Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

    Affected: from 6.3.0, fixed in 6.4.40; from 7.4.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.

  • Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

    Affected: from 7.4.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.

  • CVE-2026-45063Critical 9.1

    Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator

    Affected: fixed in 5.4.52; from 6.0.0-BETA1, fixed in 6.4.40; from 7.0.0-BETA1, fixed in 7.4.12; from 8.0.0-BETA1, fixed in 8.0.12.

  • Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

    Affected: from 7.1.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.

  • Symphony has an Authentication Bypass via RememberMe

    Affected: from 5.3.0, fixed in 5.4.47; from 6.0.0-BETA1, fixed in 6.4.15; from 7.0.0-BETA1, fixed in 7.1.8.

  • CVE-2023-46733Medium 6.5

    Symfony possible session fixation vulnerability

    Affected: from 5.4.21, fixed in 5.4.31; from 6.2.7, fixed in 6.3.8.

  • CVE-2021-32693Medium 6.8

    Authentication granted with multiple firewalls

    Affected: from 5.3.0, fixed in 5.3.2.

  • CVE-2021-21424Medium 5.3

    Prevent user enumeration using Guard or the new Authenticator-based Security

    Affected: from 5.1.0, fixed in 5.2.8.

  • Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http

    Affected: from 4.4.0, fixed in 4.4.7; from 5.0.0, fixed in 5.0.7.

  • An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7.

    Affected: from 4.1.0, fixed in 4.2.12; from 4.3.0, fixed in 4.3.8.

  • In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow…

    Affected: from 2.7.0, fixed in 2.7.51; from 2.8.0, fixed in 2.8.50; from 3.0.0, fixed in 3.4.26; from 4.0.0, fixed in 4.1.12; from 4.2.0, fixed in 4.2.7.

  • An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before…

    Affected: from 2.7.38, fixed in 2.7.50; from 2.8.0, fixed in 2.8.49; from 3.0.0, fixed in 3.4.20; from 4.0.0, fixed in 4.0.15; from 4.1.0, fixed in 4.1.9; from 4.2.0, fixed in 4.2.1.

Show all 21 advisoriesShow fewer advisories

  • An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before…

    Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.

  • An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before…

    Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.

  • An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13.

    Affected: from 2.7.0, fixed in 2.7.38; from 2.8.0, fixed in 2.8.31; from 3.2.0, fixed in 3.2.14; from 3.3.0, fixed in 3.3.13.

  • The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before…

    Affected: from 2.3.0, fixed in 2.3.41; from 2.4.0, fixed in 2.7.13; from 2.8.0, fixed in 2.8.6; from 3.0.0, fixed in 3.0.6.

  • Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a…

    Affected: from 2.4.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.7.

  • Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before…

    Affected: from 2.4.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.7.