MediumGHSA-29fc-p6c4-24cgCVE-2026-45069

Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Published 27 May 2026 · Updated 10 Sept 2026

Affected packages

symfony/security-httpComposer
Affected
>=6.3.0 <6.4.40
Fixed in
6.4.40
Update to the fixed version for your release line, for example:composer require symfony/security-http:^6.4.40
symfony/security-httpComposer
Affected
>=7.4.0 <7.4.12
Fixed in
7.4.12
Update to the fixed version for your release line, for example:composer require symfony/security-http:^7.4.12
symfony/security-httpComposer
Affected
>=8.0.0 <8.0.12
Fixed in
8.0.12
Update to the fixed version for your release line, for example:composer require symfony/security-http:^8.0.12
symfony/symfonyComposer
Affected
>=6.3.0 <6.4.40
Fixed in
6.4.40
Update to the fixed version for your release line, for example:composer require symfony/symfony:^6.4.40
symfony/symfonyComposer
Affected
>=7.4.0 <7.4.12
Fixed in
7.4.12
Update to the fixed version for your release line, for example:composer require symfony/symfony:^7.4.12
symfony/symfonyComposer
Affected
>=8.0.0 <8.0.12
Fixed in
8.0.12
Update to the fixed version for your release line, for example:composer require symfony/symfony:^8.0.12

Details

Description

OidcTokenHandler is Symfony's built-in access-token handler for OpenID Connect: it validates a bearer JWT and returns the authenticated user identity. It delegates claim validation to the web-token/jwt-checker library's ClaimCheckerManager.

OidcTokenHandler::verifyClaims() registers audience (aud), issuer (iss), and expiry (exp) checkers, but never passes the $mandatoryClaims argument to ClaimCheckerManager::check(). That method only validates claims that are *present* in the token: a checker for an absent claim is silently skipped. A validly-signed JWT that simply omits aud, iss, and exp therefore passes verification.

Resolution

The OidcTokenHandler now calls the ClaimCheckerManager with the list of mandatory claims so that tokens missing aud, iss, or exp are rejected.

The patch for this issue is available here for branch 6.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Is GHSA-29fc-p6c4-24cg in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/security-http, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.