Security Flaw in Symfony's Authentication Component Affects User Accounts

CVE-2026-123746

What is CVE-2026-123746?

A critical vulnerability in the Symfony Security HTTP component's AuthenticatorManager::authenticateUser() method allows users to bypass authentication checks. Specifically, when a user is authenticated programmatically, the firewall’s user checker’s checkPostAuth() method is not executed. This lapse permits an account that has been rejected by a custom user checker—such as one configured to deny access to expired accounts—to be authenticated erroneously. The flaw primarily impacts applications with custom user checkers that utilize programmatic authentication, particularly following a password reset or email verification. To mitigate this issue, the updated functionality ensures that the security.authentication.success event is dispatched during token creation, effectively allowing checkPostAuth() to execute and reject unauthorized users.

References