MEDIUMPackagist
GHSA-29fc-p6c4-24cg· CVE-2026-45069Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Modified: 9/10/2026
package
Packagist/symfony/security-http
pkg:packagist/symfony/security-http
MEDIUM5.3Packagist
GHSA-4vpc-5jx4-cfqg· CVE-2019-18886User enumeration leak using switch user functionality in Symfony
Modified: 11/8/2023
MEDIUM5.3Packagist
GHSA-5pv8-ppvj-4h68· BIT-symfony-2021-21424, CVE-2021-21424Prevent user enumeration using Guard or the new Authenticator-based Security
Modified: 9/10/2026
HIGHPackagist
GHSA-6439-2f28-8p8q· CVE-2026-45075Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
Modified: 9/10/2026
HIGHPackagist
GHSA-6h46-9jf5-q59x· CVE-2026-48489Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Modified: 9/10/2026
MEDIUM6.1Packagist
GHSA-89r2-5g34-2g47· CVE-2018-19790Symfony Open Redirect
Modified: 4/25/2024
HIGH7.5Packagist
GHSA-cchx-mfrc-fwqr· CVE-2019-10911Improper authentication in Symfony
Modified: 2/16/2024
HIGH7.5Packagist
GHSA-cg23-qf8f-62rr· CVE-2024-51996Symfony has an Authentication Bypass via RememberMe
Modified: 11/15/2024
LOWPackagist
GHSA-g2qj-pmxm-9f8fUser enumeration in authentication mechanisms
Modified: 12/2/2024
HIGH8.8Packagist
GHSA-g4g7-q726-v5hg· CVE-2018-11406Symfony CSRF Token Fixation
Modified: 2/18/2024
HIGH7.6Packagist
GHSA-g4m9-5hpf-hx72· BIT-symfony-2020-5275, CVE-2020-5275Firewall configured with unanimous strategy was not actually unanimous in Symfony
Modified: 9/10/2026
HIGH8.1Packagist
GHSA-g4rg-rw65-8hfg· CVE-2018-11385Symfony Session Fixation Vulnerability
Modified: 2/18/2024
HIGHPackagist
GHSA-g97c-jfx6-xvxh· CVE-2015-8125Symfony Vulnerable to Timing Attack
Modified: 11/30/2024
LOW3.1Packagist
GHSA-j5jh-hpr4-h332· CVE-2015-8124Symfony Session Fixation Vulnerability
Modified: 2/16/2024
MEDIUMPackagist
GHSA-j8gj-9rm5-4xhx· CVE-2026-45074Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Modified: 9/10/2026
MEDIUM6.5Packagist
GHSA-m2wj-r6g3-fxfx· BIT-symfony-2023-46733, CVE-2023-46733Symfony possible session fixation vulnerability
Modified: 9/10/2026
HIGHPackagist
GHSA-ph86-p8f6-f9r2· CVE-2026-45063Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
Modified: 9/10/2026
MEDIUM6.1Packagist
GHSA-r7p7-qr7p-2rrf· CVE-2017-16652Symfony Open Redirect
Modified: 2/16/2024
MEDIUM6.8Packagist
GHSA-rfcf-m67m-jcrq· BIT-symfony-2021-32693, CVE-2021-32693Authentication granted to all firewalls instead of just one
Modified: 7/8/2026
HIGH7.5Packagist
GHSA-whgv-8cg3-7hcm· CVE-2016-4423Symphony Denial of Service Via Overlong Usernames
Modified: 12/8/2024