# CVE-2026-45074: Symfony Cas2Handler authentication bypass via Host header spoofing

Source: https://junglewise.ai/threats/cve-2026-45074-symfony-cas2handler-authentication-bypass-via-host-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-45074 · Severity: medium · CVSS 4 · Published 2026-07-14

A vulnerability in the Symfony web framework could allow an attacker to impersonate legitimate users. If a website uses Central Authentication Service (CAS) for logins and has not restricted which hostnames it trusts, an attacker can reuse a security ticket from a different application to log in as a victim. This could lead to unauthorized access to sensitive user accounts and data.

Technologies: [symfony/security-http (Packagist)](https://junglewise.ai/threats/technologies/symfony-security-http), [symfony/symfony (Packagist)](https://junglewise.ai/threats/technologies/symfony-symfony), [Symfony Security HTTP](https://junglewise.ai/threats/technologies/security-http). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Symfony](https://junglewise.ai/threats/vendors/symfony).

## Quick answers

**Is CVE-2026-45074 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45074 being exploited in the wild.

**How severe is CVE-2026-45074?** Medium severity, with a CVSS score of 4, published 14 July 2026.

**Which products and versions are affected?** symfony/security-http (Packagist) ECOSYSTEM:introduced=7.1.0,fixed=7.4.12; symfony/symfony (Packagist) ECOSYSTEM:introduced=7.1.0,fixed=7.4.12; Symfony Security HTTP >= 7.1.0, < 7.4.12; >= 8.0.0, < 8.0.12.

**Is there a fix for CVE-2026-45074?** Yes. symfony/security-http (Packagist): upgrade to 7.4.12 or later; symfony/symfony (Packagist): upgrade to 7.4.12 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45074 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45074?** Check whether you run symfony/security-http (Packagist), symfony/symfony (Packagist) or Symfony Security HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- symfony/security-http (Packagist): upgrade to 7.4.12 or later

  ```sh
  composer require symfony/security-http:^7.4.12
  ```

- symfony/symfony (Packagist): upgrade to 7.4.12 or later

  ```sh
  composer require symfony/symfony:^7.4.12
  ```


## Technical details

The vulnerability exists in the Cas2Handler component of Symfony's security-http package. When the 'framework.trusted_hosts' configuration is not set, the handler uses Request::getSchemeAndHttpHost() to build the CAS service parameter, which reflects the HTTP Host header provided by the client. An attacker who controls another application registered on the same CAS server can capture a victim's service ticket and replay it against the vulnerable Symfony application by spoofing the Host header. This results in an authentication bypass (CWE-290). The fix requires the configuration of trusted hosts, causing the application to throw a LogicException if they are missing or a SuspiciousOperationException if a spoofed header is detected.

## Affected products

- Symfony symfony/security-http >= 7.1.0-BETA1, < 7.4.12
- Symfony symfony/security-http >= 8.0.0-BETA1, < 8.0.12
- Symfony symfony/symfony >= 7.1.0-BETA1, < 7.4.12
- Symfony symfony/symfony >= 8.0.0-BETA1, < 8.0.12

## Identifiers

- CVE-2026-45074
- GHSA-j8gj-9rm5-4xhx

## Timeline

- 2026-05-20: advisory: GitHub Security Advisory GHSA-j8gj-9rm5-4xhx published
- 2026-05-20: patched: Fixed in versions 7.4.12 and 8.0.12
- 2026-07-14: disclosed: CVE-2026-45074 published to NVD

## References

- [https://github.com/symfony/symfony/commit/5ba145dba702404801bdf9e7e8d6df170060d541](https://github.com/symfony/symfony/commit/5ba145dba702404801bdf9e7e8d6df170060d541)
- [https://github.com/symfony/symfony/releases/tag/v7.4.12](https://github.com/symfony/symfony/releases/tag/v7.4.12)
- [https://github.com/symfony/symfony/releases/tag/v8.0.12](https://github.com/symfony/symfony/releases/tag/v8.0.12)
- [https://github.com/symfony/symfony/security/advisories/GHSA-j8gj-9rm5-4xhx](https://github.com/symfony/symfony/security/advisories/GHSA-j8gj-9rm5-4xhx)

## Related threats

- [Symfony YAML stack exhaustion in inline lexer](https://junglewise.ai/threats/cve-2026-109413-in-symfony-yaml-prior-to-versions-5-4-54-6-4-45-7-4-18-and-8-1-6)
- [Symfony HTTP Foundation ReDoS in HeaderUtils::split()](https://junglewise.ai/threats/cve-2026-108082-symfony-is-a-php-framework-for-web-and-console-applications-and)
- [Symfony Routing improper dot-segment encoding in UrlGenerator](https://junglewise.ai/threats/cve-2026-48784-symfony-routing-improper-dot-segment-encoding-in-urlgenerator)
- [Symfony HtmlSanitizer XSS via incomplete URL attribute sanitization](https://junglewise.ai/threats/cve-2026-48761-symfony-htmlsanitizer-xss-via-incomplete-url-attribute)
- [Symfony HtmlSanitizer visual spoofing via percent-encoded BiDi characters](https://junglewise.ai/threats/cve-2026-48760-symfony-htmlsanitizer-visual-spoofing-via-percent-encoded-bidi)