Credential Disclosure in Symfony HttpClient due to Improper URL Handling
CVE-2026-121971

8.2HIGH

Key Information:

Vendor

Sensiolabs

Status
Symfony
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121971?

The Symfony HttpClient has a vulnerability in the ScopingHttpClient component that can lead to the unintended exposure of credentials. When constructing requests, this component improperly merges authentication options with request URLs. If an attacker can influence the beginning of a URL, they may exploit this flaw to send requests to a malicious origin, unintentionally including sensitive credentials. This issue poses a significant risk as it allows sensitive information to be disclosed to unauthorized servers, especially in setups where base_uri and credential configurations are used.

Affected Version(s)

symfony 0 < 5.4.56

symfony 6.0.0 < 6.4.50

symfony 7.0.0 < 7.4.23

References

https://github.com/symfony/symfony/security/advisories/GH...
third-party-advisory
https://github.com/symfony/symfony/commit/64c34e85bd03b3f...
patch

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nicolas Grekas
Thomas Chauchefoin from Trail of Bits
.