symfony security-http vulnerabilities

Newest CVEs

• CVE-2026-48489

  Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

  symfony · symfony

  High8.7
• CVE-2026-45069

  Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

  symfony · symfony

  High8.8
• CVE-2026-45075

  Symfony: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

  symfony · symfony

  High8.3
• CVE-2026-45074

  Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

  symfony · symfony

  High7.6