Search for packages
| purl | pkg:composer/symfony/security-http@7.4.8 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-6h46-9jf5-q59x
Aliases: CVE-2026-48489 |
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured … |
Not vulnerable |
|
GHSA-j8gj-9rm5-4xhx
Aliases: CVE-2026-45074 |
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay `Cas2Handler` builds this `service` parameter from … |
Vulnerable |
|
GHSA-ph86-p8f6-f9r2
Aliases: CVE-2026-45063 |
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator ### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web … |
Vulnerable |
|
GHSA-29fc-p6c4-24cg
Aliases: CVE-2026-45069 |
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims ### Description `OidcTokenHandler` is Symfony's built-in access-token handler for OpenID Connect: it validates … |
Vulnerable |
|
GHSA-6439-2f28-8p8q
Aliases: CVE-2026-45075 |
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] ### Description Symfony's `#[IsGranted('...')]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` … |
Vulnerable Vulnerable |