Symfony / Security-Http
4 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-48489 | Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes | HIGH | 8.7 | Jul 14, 2026 |
| CVE-2026-45069 | Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims | HIGH | 8.8 | Jul 14, 2026 |
| CVE-2026-45075 | Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid] | HIGH | 8.6 | Jul 14, 2026 |
| CVE-2026-45074 | Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay | HIGH | 7.6 | Jul 14, 2026 |
Showing 1 to 4 of 4 CVEs