CVE-2026-45063

Katalog CVE

CVSS 9.1 · Critical EPSS 0,37%

Kerentanan Authentication Bypass by Spoofing pada sensiolabs symfony. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Rincian

Terbit di NVD

14 Juli 2026

Terakhir diubah

15 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/symfony/symfony/security/advisories/GHSA-ph86-p8f6-f9r2 patch · advisory vendor
• https://github.com/symfony/symfony/commit/59ef484029601a7af06f5e06c6ed921fdcea5a0d patch
• https://github.com/symfony/symfony/releases/tag/v5.4.52 product · release notes
• https://github.com/symfony/symfony/releases/tag/v6.4.40 product · release notes
• https://github.com/symfony/symfony/releases/tag/v7.4.12 product · release notes
• https://github.com/symfony/symfony/releases/tag/v8.0.12 product · release notes