Skip to content

Product

symfony/security-http vulnerabilities

22 published CVES affecting symfony/security-http, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
22
Critical
1
High
13
Medium
6
Low
1
Unscored
1
CISA KEV
0

Latest symfony/security-http CVEs

Newest publication first

  4. CVE-2026-45069 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

    Published
    HighCVSS 8.8 EPSS 0.26% PoC

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to...

  8. CVE-2024-51996 Symphony has an Authentication Bypass via RememberMe

    Published
    HighCVSS 7.5 EPSS 0.62% PoC

    Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authenti...

  9. CVE-2023-46733 Symfony possible session fixation vulnerability

    Published
    MediumCVSS 6.5 EPSS 0.86%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, SessionStrategyListener does not migrate the session after every successful login. It does so only in ca...

  10. CVE-2021-32693 Authentication granted with multiple firewalls

    Published
    HighCVSS 8.8 EPSS 1.4% PoC

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticat...

  11. GHSA-g2qj-pmxm-9f8f User enumeration in authentication mechanisms

    Published
    Unknown

    Description The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating a...

  14. CVE-2019-18886 User enumeration leak using switch user functionality in Symfony

    Published
    MediumCVSS 5.3 EPSS 1.6% PoC

    An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/s...

  15. CVE-2019-10911 Improper authentication in Symfony

    Published
    HighCVSS 7.5 EPSS 1.2% PoC

    In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related t...

  16. CVE-2018-19790 Symfony Open Redirect

    Published
    MediumCVSS 6.1 EPSS 1.5% PoC

    An open redirect was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9 and 4.2.x before 4.2.1. By using backslashes in the _failure_path input field of login forms, an attacker can work around the redirectio...

  17. CVE-2017-16652 Symfony Open Redirect

    Published
    MediumCVSS 6.1 EPSS 0.77% PoC

    An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response,...

  18. CVE-2018-11385 Symfony Session Fixation Vulnerability

    Published
    HighCVSS 8.1 EPSS 2.0% PoC

    An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victi...

  19. CVE-2018-11406 Symfony CSRF Token Fixation

    Published
    HighCVSS 8.8 EPSS 0.75% PoC

    An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through...

  20. CVE-2016-4423 Symphony Denial of Service Via Overlong Usernames

    Published
    HighCVSS 7.5 EPSS 1.9% PoC

    The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allow...

  21. CVE-2015-8124 Symfony Session Fixation Vulnerability

    Published
    MediumCVSS 6.8 EPSS 2.7% PoC

    Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 allows remote attackers to hijack web sessions via a session id.

  22. CVE-2015-8125 Symfony Vulnerable to Timing Attack

    Published
    HighCVSS 7.5 EPSS 2.5% PoC

    Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or (2) Symfony/Component/Securi...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.