# symfony/security-http (Packagist) vulnerabilities

21 known vulnerabilities (1 critical, 7 high, 3 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/symfony/security-http

## Advisories (21)

### [CVE-2026-123746](https://cve.now/CVE-2026-123746): Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

- Severity: Low 2.3
- Published: Nov 6, 2026
- Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.

### [CVE-2026-118513](https://cve.now/CVE-2026-118513): Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)

- Severity: High 7.7
- Published: Nov 4, 2026
- Affected: fixed in 5.4.56; from 6.0.0, fixed in 6.4.50; from 7.0.0, fixed in 7.4.23; from 8.0.0, fixed in 8.1.11.

### [CVE-2026-48489](https://cve.now/CVE-2026-48489): Symfony: Security Firewall Bypass via failure\_forward Subrequest: Unauthenticated Access to access\_control-Protected GET Routes

- Severity: High 8.7
- Published: Jul 14, 2026
- Affected: fixed in 5.4.53; from 6.0.0, fixed in 6.4.41; from 7.0.0, fixed in 7.4.13; from 8.0.0, fixed in 8.0.13.

### [CVE-2026-45069](https://cve.now/CVE-2026-45069): Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

- Severity: High 8.8
- Published: Jul 14, 2026
- Affected: from 6.3.0, fixed in 6.4.40; from 7.4.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.

### [CVE-2026-45075](https://cve.now/CVE-2026-45075): Symfony: HEAD Request Bypasses methods: \['GET'\] Filter in #\[IsGranted\] / #\[IsSignatureValid\] / #\[IsCsrfTokenValid\]

- Severity: High 8.3
- Published: Jul 14, 2026
- Affected: from 7.4.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.

### [CVE-2026-45063](https://cve.now/CVE-2026-45063): Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator

- Severity: Critical 9.1
- Published: Jul 14, 2026
- Affected: fixed in 5.4.52; from 6.0.0-BETA1, fixed in 6.4.40; from 7.0.0-BETA1, fixed in 7.4.12; from 8.0.0-BETA1, fixed in 8.0.12.

### [CVE-2026-45074](https://cve.now/CVE-2026-45074): Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

- Severity: High 7.6
- Published: Jul 14, 2026
- Affected: from 7.1.0, fixed in 7.4.12; from 8.0.0, fixed in 8.0.12.

### [CVE-2024-51996](https://cve.now/CVE-2024-51996): Symphony has an Authentication Bypass via RememberMe

- Severity: High 7.5
- Published: Nov 13, 2024
- Affected: from 5.3.0, fixed in 5.4.47; from 6.0.0-BETA1, fixed in 6.4.15; from 7.0.0-BETA1, fixed in 7.1.8.

### [CVE-2023-46733](https://cve.now/CVE-2023-46733): Symfony possible session fixation vulnerability

- Severity: Medium 6.5
- Published: Nov 10, 2023
- Affected: from 5.4.21, fixed in 5.4.31; from 6.2.7, fixed in 6.3.8.

### [CVE-2021-32693](https://cve.now/CVE-2021-32693): Authentication granted with multiple firewalls

- Severity: Medium 6.8
- Published: Jun 17, 2021
- Affected: from 5.3.0, fixed in 5.3.2.

### [CVE-2021-21424](https://cve.now/CVE-2021-21424): Prevent user enumeration using Guard or the new Authenticator-based Security

- Severity: Medium 5.3
- Published: May 13, 2021
- Affected: from 5.1.0, fixed in 5.2.8.

### [CVE-2020-5275](https://cve.now/CVE-2020-5275): Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http

- Severity: High 7.6
- Published: Mar 30, 2020
- Affected: from 4.4.0, fixed in 4.4.7; from 5.0.0, fixed in 5.0.7.

### [CVE-2019-18886](https://cve.now/CVE-2019-18886): An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7.

- Severity: Unrated
- Published: Nov 21, 2019
- Affected: from 4.1.0, fixed in 4.2.12; from 4.3.0, fixed in 4.3.8.

### [CVE-2019-10911](https://cve.now/CVE-2019-10911): In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow…

- Severity: Unrated
- Published: May 16, 2019
- Affected: from 2.7.0, fixed in 2.7.51; from 2.8.0, fixed in 2.8.50; from 3.0.0, fixed in 3.4.26; from 4.0.0, fixed in 4.1.12; from 4.2.0, fixed in 4.2.7.

### [CVE-2018-19790](https://cve.now/CVE-2018-19790): An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before…

- Severity: Unrated
- Published: Dec 18, 2018
- Affected: from 2.7.38, fixed in 2.7.50; from 2.8.0, fixed in 2.8.49; from 3.0.0, fixed in 3.4.20; from 4.0.0, fixed in 4.0.15; from 4.1.0, fixed in 4.1.9; from 4.2.0, fixed in 4.2.1.

### [CVE-2018-11406](https://cve.now/CVE-2018-11406): An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before…

- Severity: Unrated
- Published: Jun 13, 2018
- Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.

### [CVE-2018-11385](https://cve.now/CVE-2018-11385): An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before…

- Severity: Unrated
- Published: Jun 13, 2018
- Affected: from 2.7.0, fixed in 2.7.48; from 2.8.0, fixed in 2.8.41; from 3.0.0, fixed in 3.3.17; from 3.4.0, fixed in 3.4.11; from 4.0.0, fixed in 4.0.11.

### [CVE-2017-16652](https://cve.now/CVE-2017-16652): An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13.

- Severity: Unrated
- Published: Jun 13, 2018
- Affected: from 2.7.0, fixed in 2.7.38; from 2.8.0, fixed in 2.8.31; from 3.2.0, fixed in 3.2.14; from 3.3.0, fixed in 3.3.13.

### [CVE-2016-4423](https://cve.now/CVE-2016-4423): The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before…

- Severity: Unrated
- Published: Jun 1, 2016
- Affected: from 2.3.0, fixed in 2.3.41; from 2.4.0, fixed in 2.7.13; from 2.8.0, fixed in 2.8.6; from 3.0.0, fixed in 3.0.6.

### [CVE-2015-8125](https://cve.now/CVE-2015-8125): Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a…

- Severity: Unrated
- Published: Dec 7, 2015
- Affected: from 2.4.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.7.

### [CVE-2015-8124](https://cve.now/CVE-2015-8124): Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before…

- Severity: Unrated
- Published: Dec 7, 2015
- Affected: from 2.4.0, fixed in 2.6.12; from 2.7.0, fixed in 2.7.7.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/symfony/security-http
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.