CVE-2026-45063: Symfony X509Authenticator authentication bypass via spoofing

CVE-2026-45063 · Severity: high · CVSS 4 · Published 2026-07-14

A vulnerability in the Symfony web framework allows unauthorized users to impersonate other people. By using a specially crafted digital certificate, an attacker can trick the system into identifying them as a different user, potentially gaining full access to that user's account and data. This affects applications using X.509 certificate-based authentication.

Technologies: symfony/security-http (Packagist), symfony/symfony (Packagist), Symfony Security HTTP. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-45063 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45063 being exploited in the wild.
How severe is CVE-2026-45063?
High severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/security-http (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; symfony/symfony (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.52; Symfony Security HTTP < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12.
Is there a fix for CVE-2026-45063?
Yes. symfony/security-http (Packagist): upgrade to 5.4.52 or later; symfony/symfony (Packagist): upgrade to 5.4.52 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45063 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45063?
Check whether you run symfony/security-http (Packagist), symfony/symfony (Packagist) or Symfony Security HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/security-http (Packagist): upgrade to 5.4.52 or later
    composer require symfony/security-http:^5.4.52
  • symfony/symfony (Packagist): upgrade to 5.4.52 or later
    composer require symfony/symfony:^5.4.52

Technical details

The X509Authenticator in Symfony extracts user identifiers from the 'SSL_CLIENT_S_DN' server variable using an unanchored regular expression. This regex matches 'emailAddress=' anywhere within the Distinguished Name (DN) string rather than strictly at the start of a Relative Distinguished Name (RDN) boundary. An attacker with a valid, trusted certificate can embed a victim's email address within a different field (such as the Common Name) to successfully authenticate as that victim. The issue is resolved by anchoring the regex to RDN boundaries in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Affected products

  • Symfony symfony/symfony < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12

Identifiers

  • CVE-2026-45063
  • GHSA-ph86-p8f6-f9r2

Timeline

  • 2026-07-14: disclosed
  • 2026-07-14: advisory
  • 2026-05-20: patched: Release date of fixed versions

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.