Is CVE-2026-121971 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121971 being exploited in the wild.

How severe is CVE-2026-121971?

Informational severity, published 4 November 2026.

Which products and versions are affected?

Symfony HttpClient 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11.

Is there a fix for CVE-2026-121971?

Yes: fixed in Symfony HttpClient 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121971 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-121971?

Check whether you run Symfony HttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121971: Symfony HttpClient credential disclosure via URL override

CVE-2026-121971 · Severity: info · Published 2026-11-04

Symfony HttpClient's ScopingHttpClient component uses credentials (such as bearer tokens or basic auth) configured for one domain to make requests to attacker-controlled domains when processing specially crafted URLs. An attacker who can control part of a URL passed to an HTTP client configured with credentials can trick the client into sending those credentials to their server, leading to credential theft.

Technologies: Symfony HttpClient. Vendors: Symfony.

Quick answers

Is CVE-2026-121971 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121971 being exploited in the wild.
How severe is CVE-2026-121971?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Symfony HttpClient 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11.
Is there a fix for CVE-2026-121971?: Yes: fixed in Symfony HttpClient 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121971 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-121971?: Check whether you run Symfony HttpClient at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Symfony HttpClient 5.4.56, 6.4.50, 7.4.23, 8.1.11

Technical details

ScopingHttpClient merges default scope options (auth_bearer, auth_basic, headers, client certificates) before resolving relative URLs against the base_uri. When a network-path reference like "//evil.example/steal" is provided, it resolves outside the base URI's origin but retains the merged credentials. The vulnerability exists because URL resolution happens before scheme and authority validation. The fix compares the resolved URL's scheme and authority against the base URI to drop default scope options when they differ.

Affected products

Symfony HttpClient 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.