Search for packages
| purl | pkg:composer/symfony/security-http@8.0.12 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-6h46-9jf5-q59x
Aliases: CVE-2026-48489 |
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes ### Description When a firewall is configured … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-j8gj-9rm5-4xhx
|
Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay `Cas2Handler` builds this `service` parameter from … |
CVE-2026-45074
|
|
GHSA-ph86-p8f6-f9r2
|
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator ### Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web … |
CVE-2026-45063
|
|
GHSA-29fc-p6c4-24cg
|
Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims ### Description `OidcTokenHandler` is Symfony's built-in access-token handler for OpenID Connect: it validates … |
CVE-2026-45069
|
|
GHSA-6439-2f28-8p8q
|
Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] ### Description Symfony's `#[IsGranted('...')]`, `#[IsSignatureValid]`, and `#[IsCsrfTokenValid(...)]` … |
CVE-2026-45075
|