Attack Chain

1. Attacker obtains a certificate from a trusted Certificate Authority (CA).
2. When requesting the certificate, the attacker sets the Common Name (CN) field to include a malicious string like CN=Attacker emailAddress=victim@example.com,O=AttackerOrg.
3. The attacker presents the certificate to a Symfony application configured to use X509Authenticator for authentication.
4. The web server validates the certificate against the trusted CA.
5. The web server passes the certificate’s Subject DN to Symfony via the $_SERVER['SSL_CLIENT_S_DN'] variable.
6. Symfony’s X509Authenticator extracts the user identifier using an unanchored regex.
7. Due to the unanchored regex, the authenticator incorrectly identifies victim@example.com as the user’s email address from the CN.
8. The attacker is authenticated as victim@example.com, gaining unauthorized access to the victim’s account.

Impact

Successful exploitation of this vulnerability allows an attacker to impersonate legitimate users on affected Symfony applications. This could lead to unauthorized access to sensitive data, modification of user accounts, or other malicious activities depending on the permissions and roles assigned to the compromised user account. The vulnerability impacts applications using client certificate authentication with the flawed X509Authenticator component.

Recommendation

• Upgrade symfony/security-http and symfony/symfony to the latest patched versions (>= 5.4.52, >= 6.4.40, >= 7.4.12, >= 8.0.12) as provided by the vendor to remediate CVE-2026-45063.
• Deploy the Sigma rule Detect Symfony X509Authenticator Authentication Bypass to detect attempts to exploit this vulnerability by monitoring for requests with manipulated SSL_CLIENT_S_DN values.
• If upgrading is not immediately feasible, consider implementing a temporary workaround by sanitizing the $_SERVER['SSL_CLIENT_S_DN'] value before it is processed by the X509Authenticator to prevent exploitation of the unanchored regex.