Skip to content
Threat Feed

Product

Symfony/Symfony >= 7.0.0-BETA1, < 7.4.12

1 brief RSS
high advisory

Symfony X509Authenticator Identity Spoofing Vulnerability (CVE-2026-45063)

Symfony's X509Authenticator is vulnerable to identity spoofing due to an unanchored regex in the extraction of the user identifier from the Subject DN of client certificates, allowing attackers to authenticate as other users by crafting a certificate with a malicious CN value.

symfony/security-http < 5.4.52 +7 symfony authentication bypass identity spoofing CVE-2026-45063
2r 1t