PHP Framework Vulnerability in Symfony Affects Authentication Security
CVE-2026-45074
What is CVE-2026-45074?
A vulnerability in the Symfony PHP framework allows attackers to exploit misconfigurations of the framework's trusted hosts. Specifically, from versions 7.1.0 to 7.4.12 and in 8.0.12, the Cas2Handler constructs the CAS service parameter using an attacker-controlled Host header if the framework's trusted_hosts configuration is not properly set. This flaw can enable an attacker to replay authentication tickets from victims if they manage another application registered with the same CAS server, compromising the authentication flow of the Symfony application. The issue has been addressed in the releases 7.4.12 and 8.0.12.
Affected Version(s)
security-http >= 7.1.0-BETA1, < 7.4.12 < 7.1.0-BETA1, 7.4.12
security-http >= 8.0.0-BETA1, < 8.0.12 < 8.0.0-BETA1, 8.0.12
symfony >= 7.1.0-BETA1, < 7.4.12 < 7.1.0-BETA1, 7.4.12