Executive brief
A vulnerability in the Symfony web framework could allow an attacker to impersonate legitimate users. If a website uses Central Authentication Service (CAS) for logins and has not restricted which hostnames it trusts, an attacker can reuse a security ticket from a different application to log in as a victim. This could lead to unauthorized access to sensitive user accounts and data.
Technical details
The vulnerability exists in the Cas2Handler component of Symfony's security-http package. When the 'framework.trusted_hosts' configuration is not set, the handler uses Request::getSchemeAndHttpHost() to build the CAS service parameter, which reflects the HTTP Host header provided by the client. An attacker who controls another application registered on the same CAS server can capture a victim's service ticket and replay it against the vulnerable Symfony application by spoofing the Host header. This results in an authentication bypass (CWE-290). The fix requires the configuration of trusted hosts, causing the application to throw a LogicException if they are missing or a SuspiciousOperationException if a spoofed header is detected.
Affected products
- Symfony symfony/security-http >= 7.1.0-BETA1, < 7.4.12
- Symfony symfony/security-http >= 8.0.0-BETA1, < 8.0.12
- Symfony symfony/symfony >= 7.1.0-BETA1, < 7.4.12
- Symfony symfony/symfony >= 8.0.0-BETA1, < 8.0.12
Timeline
- 2026-05-20: advisory: GitHub Security Advisory GHSA-j8gj-9rm5-4xhx published
- 2026-05-20: patched: Fixed in versions 7.4.12 and 8.0.12
- 2026-07-14: disclosed: CVE-2026-45074 published to NVD