Is CVE-2026-123746 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123746 being exploited in the wild.

How severe is CVE-2026-123746?

Informational severity, published 6 November 2026.

Which products and versions are affected?

Symfony Security HTTP component 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11.

Is there a fix for CVE-2026-123746?

Yes: fixed in Symfony Security HTTP 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123746 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123746?

Check whether you run Symfony Security HTTP component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123746: Symfony Security HTTP component post-authentication user checker bypass

CVE-2026-123746 · Severity: info · Published 2026-11-06

Symfony's Security HTTP component fails to perform post-authentication user validation when applications authenticate users programmatically (e.g., after password reset or email verification). This allows accounts that should be rejected—such as expired or suspended accounts—to gain authenticated sessions if the application uses custom user validation rules. The issue affects applications that have implemented custom account status checks and programmatic authentication flows.

Vendors: Symfony.

Quick answers

Is CVE-2026-123746 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123746 being exploited in the wild.
How severe is CVE-2026-123746?: Informational severity, published 6 November 2026.
Which products and versions are affected?: Symfony Security HTTP component 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11.
Is there a fix for CVE-2026-123746?: Yes: fixed in Symfony Security HTTP 5.4.56, 6.4.50, 7.4.23, 8.1.11. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123746 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123746?: Check whether you run Symfony Security HTTP component at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Symfony Security HTTP 5.4.56, 6.4.50, 7.4.23, 8.1.11

Technical details

AuthenticatorManager::authenticateUser() bypasses the security.authentication.success event dispatch, causing the firewall user checker's checkPostAuth() method to never execute during programmatic authentication. While form login and other firewall authenticators properly invoke checkPostAuth() to reject invalid accounts, the programmatic authentication path (used by UserAuthenticatorInterface and SecurityBundle's Security::login()) skips this validation. An attacker exploits this by using a programmatic login endpoint after satisfying the preceding condition (e.g., completing a password reset), bypassing custom security checks that would normally reject the user.

Affected products

Symfony Security HTTP component 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, 8.x prior to 8.1.11

Timeline

2026-11-06: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.