Executive brief
Symfony is a popular PHP framework used to build web applications. A vulnerability in its OpenID Connect (OIDC) component allows the system to accept security tokens that are missing critical safety checks, such as expiration dates or sender identity. This could allow an attacker to use expired or unauthorized tokens to gain access to user accounts or protected data.
Technical details
The OidcTokenHandler::verifyClaims() method in Symfony's security-http component fails to pass the $mandatoryClaims argument to the ClaimCheckerManager::check() method. While audience (aud), issuer (iss), and expiry (exp) checkers are registered, the underlying library only validates claims that are present in the token. Consequently, a validly signed JWT that omits these mandatory claims will pass verification instead of being rejected. This allows for the use of tokens that have expired or were intended for different audiences. The issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12 by explicitly passing the list of mandatory claims during verification.
Affected products
- Symfony symfony/security-http >= 6.3.0, < 6.4.40; >= 7.4.0, < 7.4.12; >= 8.0.0, < 8.0.12
- Symfony symfony/symfony >= 6.3.0, < 6.4.40; >= 7.4.0, < 7.4.12; >= 8.0.0, < 8.0.12
Timeline
- 2026-05-20: patched: Fixed versions 6.4.40, 7.4.12, and 8.0.12 released.
- 2026-05-20: advisory: GitHub Security Advisory GHSA-29fc-p6c4-24cg published.
- 2026-07-14: disclosed: CVE-2026-45069 published to NVD.