MediumGHSA-j8gj-9rm5-4xhxCVE-2026-45074

Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

Published 27 May 2026 · Updated 10 Sept 2026

Affected packages

symfony/security-httpComposer

Affected: >=7.1.0 <7.4.12
Fixed in: 7.4.12

Update to the fixed version for your release line, for example:composer require symfony/security-http:^7.4.12

symfony/security-httpComposer

Affected: >=8.0.0 <8.0.12
Fixed in: 8.0.12

Update to the fixed version for your release line, for example:composer require symfony/security-http:^8.0.12

symfony/symfonyComposer

Affected: >=7.1.0 <7.4.12
Fixed in: 7.4.12

Update to the fixed version for your release line, for example:composer require symfony/symfony:^7.4.12

symfony/symfonyComposer

Affected: >=8.0.0 <8.0.12
Fixed in: 8.0.12

Update to the fixed version for your release line, for example:composer require symfony/symfony:^8.0.12

Details

Cas2Handler builds this service parameter from Request::getSchemeAndHttpHost(), which reflects the attacker-controlled HTTP Host header whenever Symfony's framework.trusted_hosts setting is not configured (the default). An attacker who controls any *other* application registered with the same CAS server can replay a victim's ticket against the Symfony application, with a spoofed Host header, and be authenticated as that victim.

Resolution

A new required service_url configuration option is introduced on Cas2Handler. The CAS service parameter sent to the validation endpoint is now built from this configured URL instead of being derived from the request's Host header, preventing cross-service ticket replay via Host header spoofing.

The patch for this issue is available here for branch 7.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Nicolas Grekas for providing the fix.

Is GHSA-j8gj-9rm5-4xhx in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/security-http, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.