HighGHSA-ph86-p8f6-f9r2CVE-2026-45063

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

Published 27 May 2026 · Updated 10 Sept 2026

Affected packages

symfony/security-httpComposer
Affected
<5.4.52
Fixed in
5.4.52
Update to the fixed version for your release line, for example:composer require symfony/security-http:^5.4.52
symfony/security-httpComposer
Affected
>=6.0.0-BETA1 <6.4.40
Fixed in
6.4.40
Update to the fixed version for your release line, for example:composer require symfony/security-http:^6.4.40
symfony/security-httpComposer
Affected
>=7.0.0-BETA1 <7.4.12
Fixed in
7.4.12
Update to the fixed version for your release line, for example:composer require symfony/security-http:^7.4.12
symfony/security-httpComposer
Affected
>=8.0.0-BETA1 <8.0.12
Fixed in
8.0.12
Update to the fixed version for your release line, for example:composer require symfony/security-http:^8.0.12
symfony/symfonyComposer
Affected
<5.4.52
Fixed in
5.4.52
Update to the fixed version for your release line, for example:composer require symfony/symfony:^5.4.52
symfony/symfonyComposer
Affected
>=6.0.0-BETA1 <6.4.40
Fixed in
6.4.40
Update to the fixed version for your release line, for example:composer require symfony/symfony:^6.4.40
symfony/symfonyComposer
Affected
>=7.0.0-BETA1 <7.4.12
Fixed in
7.4.12
Update to the fixed version for your release line, for example:composer require symfony/symfony:^7.4.12
symfony/symfonyComposer
Affected
>=8.0.0-BETA1 <8.0.12
Fixed in
8.0.12
Update to the fixed version for your release line, for example:composer require symfony/symfony:^8.0.12

Details

Description

X509Authenticator implements client-certificate (mTLS) authentication: the web server validates the client's certificate against a trusted CA, then passes the certificate's Subject DN (Distinguished Name: a string like CN=Alice,O=Example,emailAddress=alice@example.com) to Symfony via $_SERVER['SSL_CLIENT_S_DN']. Symfony extracts the user identifier from that string.

The extraction uses an unanchored regex that matches emailAddress= anywhere in the DN string: including inside the *value* of a different RDN (Relative Distinguished Name: one key=value component of the DN), such as CN. An attacker who can obtain a certificate from a trusted CA with a free-text CN can smuggle emailAddress=victim@target inside the CN value and be authenticated as the victim.

Resolution

The X509Authenticator now uses a regex that anchors the match to an RDN boundary (start of string, or following a , / / separator).

The patch for this issue is available here for branch 5.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Is GHSA-ph86-p8f6-f9r2 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/security-http, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.