CVE-2026-118513High· 7.7▾ TwilightAuthentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary user of the application, including a privileged one, following an incomplete fix for CVE-2026-45063. X509Authenticator extracts the user identifier from the Subject DN (Distinguished Name) that the web server passes in $_SERVER['SSL_CLIENT_S_DN']. The fix for CVE-2026-45063 anchored that extraction to an RDN (Relative Distinguished Name) boundary, but the regular expression used was not escape-aware. The expression runs against an already serialized DN, so it cannot tell an RDN separator from a separator character that occurs inside a value. Under RFC 2253, used by Apache and by nginx's $ssl_client_s_dn, a comma inside a value is escaped as , and the expression reads it as a separator regardless. RFC 2253 also does not treat / as a separator, so it leaves it bare inside a value, while the expression treats every / as one. The legacy X509_NAME_oneline() format, used by Apache's LegacyDNStringFormat and by nginx's $ssl_client_s_dn_legacy, is the mirror image: it escapes / as / and leaves , bare. In that format, a certificate with no emailAddress attribute, or whose poisoned CN precedes it, authenticates as the smuggled address.
To cover both RFC 2253 and the legacy X509_NAME_oneline() format, X509Authenticator and X509AuthenticationListener now split the DN into RDNs before looking for the attribute, instead of matching the attribute against the serialized string. They select the separator from the serialization, split on unescaped occurrences of that separator only, unescape each RDN afterwards with the rules of its format, and require the attribute to span a whole RDN. The accepted value grammar is unchanged.
Applications that pass a per-attribute user key (such as SSL_CLIENT_S_DN_Email) and deployments whose CA generates or validates the subject are not affected by this vulnerability.
symfony/security-http < 5.4.56symfony/security-http >= 6.0.0 < 6.4.50symfony/security-http >= 7.0.0 < 7.4.23symfony/security-http >= 8.0.0 < 8.1.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-48489HighSymfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
CVE-2026-121949Low· 2.3Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass
CVE-2026-121971High· 8.2Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
CVE-2026-123119Low· 2.3Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Internal Ports (Incomplete Fix for CVE-2024-50342)
CVE-2026-123125Medium· 6.3Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass
CVE-2026-118517Low· 2.3Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)