← Vulnerability feed

Vulnerability record · CVE-2026-45063 · published 14 July 2026

CVE-2026-45063: Sensiolabs symfony authentication bypass by spoofing vulnerability

Sensiolabs · Symfony

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

9.1 CVSS 4.0 Critical EPSS 0.37% · top 72.1% CWE-290 · Authentication bypass by spoofing
9.1CVSS 4.0 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
15 Jul 2026Last modified by NVD

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/symfony/symfony/commit/59ef484029601a7af06f5e06c6ed921fdcea5a0d Patch
https://github.com/symfony/symfony/releases/tag/v5.4.52 ProductRelease Notes
https://github.com/symfony/symfony/releases/tag/v6.4.40 ProductRelease Notes
https://github.com/symfony/symfony/releases/tag/v7.4.12 ProductRelease Notes
https://github.com/symfony/symfony/releases/tag/v8.0.12 ProductRelease Notes
https://github.com/symfony/symfony/security/advisories/GHSA-ph86-p8f6-f9r2 PatchVendor Advisory

Track CVE-2026-45063 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-51736Sensiolabs symfony command injection vulnerabilitySymphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.…EPSS 0.43%9.8CVE-2019-11325Sensiolabs symfony vulnerabilityAn issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially…EPSS 3.4%9.8CVE-2019-18889Sensiolabs symfony code injection vulnerabilityAn issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces …EPSS 33%9.8CVE-2017-11365Sensiolabs symfony improper access control vulnerabilityCertain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3…EPSS 1.9%9.8CVE-2019-10910Sensiolabs symfony sql injection vulnerabilityIn Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this …EPSS 5.9%9.8CVE-2019-10913Sensiolabs symfony cross-site scripting vulnerabilityIn Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using …EPSS 1.9%9.8CVE-2018-11407Sensiolabs symfony improper authentication vulnerabilityAn issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It all…EPSS 2.3%9.8CVE-2016-2403Sensiolabs symfony improper authentication vulnerabilitySymfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, w…EPSS 2.9%

Source: NIST National Vulnerability Database (record CVE-2026-45063), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.