Authentication Bypass Vulnerability in Symfony Products by Symfony

CVE-2026-118513

What is CVE-2026-118513?

An authentication bypass vulnerability exists in the X509Authenticator and X509AuthenticationListener within Symfony that could allow attackers with a certificate from a trusted Certificate Authority (CA) to impersonate any user, including privileged users. This occurs due to a flaw in the user identifier extraction method from the Subject DN, which fails to properly handle separator characters in accordance with established standards. The implementation was intended to enforce RDN boundaries in the extraction process; however, it does not adequately account for escaped characters, leading to potential exploitation. Affected Symfony versions must be upgraded to a fixed version to mitigate this risk.

References