symfony/security-http Security Advisories for v7.1.3 (4)
-
[HIGH] CVE-2026-48489: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
PKSA-c28x-6bj5-8spx CVE-2026-48489 GHSA-6h46-9jf5-q59x
Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.53|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.41|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.13|>=8.0.0,<8.0.13
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[MEDIUM] CVE-2026-45074: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
PKSA-5df2-zpfk-xgsv CVE-2026-45074 GHSA-j8gj-9rm5-4xhx
Affected version: >=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[HIGH] CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator
PKSA-tbsf-h7vc-j7hn CVE-2026-45063 GHSA-ph86-p8f6-f9r2
Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12
Reported by:
GitHub, FriendsOfPHP/security-advisories -
[HIGH] CVE-2024-51996: Authentication Bypass via persisted RememberMe cookie
PKSA-rqvm-b18n-vg69 CVE-2024-51996 GHSA-cg23-qf8f-62rr
Affected version: >=5.3.0,<5.4.0|>=5.4.0,<5.4.47|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.15|>=7.0.0,<7.1.0|>=7.1.0,<7.1.8
Reported by:
GitHub, FriendsOfPHP/security-advisories