# CVE-2026-118513: Symfony X509 authentication bypass by certificate CN spoofing

Source: https://junglewise.ai/threats/cve-2026-118513-authentication-bypass-by-spoofing-in-x509authenticator-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-118513 · Severity: info · Published 2026-11-04

Symfony's X.509 certificate authentication component has a flaw that allows an attacker with a certificate from a trusted Certificate Authority to impersonate any user, including administrators, by manipulating the certificate's Common Name field. This affects web applications that use X.509 client certificates for authentication, putting user accounts and application access at risk. The vulnerability is a bypass of an earlier incomplete security fix.

Vendors: [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-118513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118513 being exploited in the wild.

**How severe is CVE-2026-118513?** Informational severity, published 4 November 2026.

**Which products and versions are affected?** Symfony 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11.

**Is there a fix for CVE-2026-118513?** Yes: fixed in Symfony 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118513 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118513?** Check whether you run Symfony at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Symfony 5.4.56, 6.4.50, 7.4.23, 8.1.11

## Technical details

The X509Authenticator and X509AuthenticationListener components extract user identifiers from the certificate's Subject Distinguished Name without properly handling escaping rules across different DN serialization formats (RFC 2253 vs. legacy X509_NAME_oneline). An attacker with a CA-signed certificate can craft a malicious CN that exploits parser confusion between escaped separators and literal characters to inject an arbitrary user identifier, bypassing authentication checks. The fix parses DNs into individual RDNs before extraction and applies format-specific unescaping rules.

## Affected products

- Symfony Symfony 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11

## Timeline

- 2026-11-04: advisory: Security advisory published