PT-2026-44143 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-27 · CVE-2026-45074

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Symfony version 7.4 (affected versions not specified)

Description The Cas2Handler builds the service parameter using Request::getSchemeAndHttpHost(), which reflects the HTTP Host header when the framework.trusted hosts setting is not configured. This allows an attacker who controls another application registered with the same CAS server to spoof the Host header and replay a victim's ticket against the application to be authenticated as that victim.

Recommendations Configure the new required service url option on Cas2Handler to ensure the CAS service parameter is built from a configured URL instead of the request's Host header.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-45074

GHSA-J8GJ-9RM5-4XHX

Affected Products

Symfony

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45074.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45074.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-j8gj-9rm5-4xhx · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45074 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45074 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45074 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45074 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45074 · Vendor Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-j8gj-9rm5-4xhx · Note
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/commit/5ba145dba702404801bdf9e7e8d6df170060d541 · Note
• https://symfony.com/blog/cve-2026-45074-cas2handler-derives-cas-service-url-from-client-host-header-cross-service-ticket-replay · Note
• https://symfony.com/cve-2026-45074 · Note