CVE-2026-45074: Symfony Cas2Handler authentication bypass via Host header spoofing

CVE-2026-45074 · Severity: medium · CVSS 4 · Published 2026-07-14

A vulnerability in the Symfony web framework could allow an attacker to impersonate legitimate users. If a website uses Central Authentication Service (CAS) for logins and has not restricted which hostnames it trusts, an attacker can reuse a security ticket from a different application to log in as a victim. This could lead to unauthorized access to sensitive user accounts and data.

Technologies: symfony/security-http (Packagist), symfony/symfony (Packagist), Symfony Security HTTP. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-45074 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45074 being exploited in the wild.
How severe is CVE-2026-45074?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
symfony/security-http (Packagist) ECOSYSTEM:introduced=7.1.0,fixed=7.4.12; symfony/symfony (Packagist) ECOSYSTEM:introduced=7.1.0,fixed=7.4.12; Symfony Security HTTP >= 7.1.0, < 7.4.12; >= 8.0.0, < 8.0.12.
Is there a fix for CVE-2026-45074?
Yes. symfony/security-http (Packagist): upgrade to 7.4.12 or later; symfony/symfony (Packagist): upgrade to 7.4.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45074 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45074?
Check whether you run symfony/security-http (Packagist), symfony/symfony (Packagist) or Symfony Security HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/security-http (Packagist): upgrade to 7.4.12 or later
    composer require symfony/security-http:^7.4.12
  • symfony/symfony (Packagist): upgrade to 7.4.12 or later
    composer require symfony/symfony:^7.4.12

Technical details

The vulnerability exists in the Cas2Handler component of Symfony's security-http package. When the 'framework.trusted_hosts' configuration is not set, the handler uses Request::getSchemeAndHttpHost() to build the CAS service parameter, which reflects the HTTP Host header provided by the client. An attacker who controls another application registered on the same CAS server can capture a victim's service ticket and replay it against the vulnerable Symfony application by spoofing the Host header. This results in an authentication bypass (CWE-290). The fix requires the configuration of trusted hosts, causing the application to throw a LogicException if they are missing or a SuspiciousOperationException if a spoofed header is detected.

Affected products

  • Symfony symfony/security-http >= 7.1.0-BETA1, < 7.4.12
  • Symfony symfony/security-http >= 8.0.0-BETA1, < 8.0.12
  • Symfony symfony/symfony >= 7.1.0-BETA1, < 7.4.12
  • Symfony symfony/symfony >= 8.0.0-BETA1, < 8.0.12

Identifiers

  • CVE-2026-45074
  • GHSA-j8gj-9rm5-4xhx

Timeline

  • 2026-05-20: advisory: GitHub Security Advisory GHSA-j8gj-9rm5-4xhx published
  • 2026-05-20: patched: Fixed in versions 7.4.12 and 8.0.12
  • 2026-07-14: disclosed: CVE-2026-45074 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.