CVE-2026-45074
CVE-2026-45074 · Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.
CVSS 7.6 · High · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
symfony
- Versions
- >= 7.1.0-BETA1, < 7.4.12: Affected
- >= 8.0.0-BETA1, < 8.0.12: Affected
No fix published
security-http
- Versions
- >= 7.1.0-BETA1, < 7.4.12: Affected
- >= 8.0.0-BETA1, < 8.0.12: Affected
No fix published
symfony Debian:14
- Versions
- 6.4.21+dfsg-2
- 6.4.24+dfsg-1
- 6.4.25+dfsg-1
- 7.0.4+dfsg-1
- 7.0.5+dfsg-1
- 7.0.6+dfsg-1
- 7.0.7+dfsg-1
- 7.1.0~beta1+dfsg-1
- 7.1.0~rc1+dfsg-1
- 7.1.2+dfsg-1
- 7.1.3+dfsg-1
- 7.1.4+dfsg-1
- 7.1.5+dfsg-1
- 7.2.0~beta1+dfsg-1
- 7.2.0~beta2+dfsg-1
- 7.2.0~rc1+dfsg-1
- 7.2.1+dfsg-1
- 7.2.2+dfsg-1
- 7.2.3+dfsg-1
- 7.2.4+dfsg-1
- 7.2.5+dfsg-1
- 7.2.6-1
- 7.3.0+dfsg-1
- 7.3.0~beta1+dfsg-1
- 7.3.0~beta2+dfsg-1
- 7.3.0~rc1+dfsg-1
- 7.3.1+dfsg-1
- 7.3.2+dfsg-1
- 7.3.3+dfsg-1
- 7.3.4+dfsg-1
- 7.3.5-1
- 7.4.0+dfsg-1
- 7.4.0+dfsg-2
- 7.4.0~beta1-1
- 7.4.0~beta1-2
- 7.4.0~beta2+dfsg-1
- 7.4.0~beta2+dfsg-2
- 7.4.0~beta2+dfsg-3
- 7.4.0~rc1+dfsg-1
- 7.4.0~rc2+dfsg-1
- 7.4.0~rc3+dfsg-1
- 7.4.10+dfsg-1
- 7.4.2+dfsg-1
- 7.4.2+dfsg-2
- 7.4.3+dfsg-1
- 7.4.4+dfsg-1
- 7.4.5+dfsg-1
- 7.4.6+dfsg-1
- 7.4.6+dfsg-2
- 7.4.7+dfsg-1
- 7.4.8+dfsg-1
- 7.4.9+dfsg-1
- Affected ranges
- ECOSYSTEM: < 7.4.12+dfsg-1
Update to 7.4.12+dfsg-1
symfony/security-http Packagist
- Versions
- v7.1.0
- v7.1.1
- v7.1.10
- v7.1.11
- v7.1.2
- v7.1.3
- v7.1.4
- v7.1.5
- v7.1.6
- v7.1.7
- v7.1.8
- v7.2.0
- v7.2.0-BETA1
- v7.2.0-BETA2
- v7.2.0-RC1
- v7.2.1
- v7.2.3
- v7.2.4
- v7.2.6
- v7.2.7
- v7.2.8
- v7.2.9
- v7.3.0
- v7.3.0-BETA1
- v7.3.0-BETA2
- v7.3.0-RC1
- v7.3.1
- v7.3.10
- v7.3.2
- v7.3.3
- v7.3.4
- v7.3.5
- v7.3.8
- v7.3.9
- v7.4.0
- v7.4.0-BETA1
- v7.4.0-RC1
- v7.4.0-RC2
- v7.4.1
- v7.4.11
- v7.4.3
- v7.4.4
- v7.4.6
- v7.4.8
- v7.4.9
- Affected ranges
- ECOSYSTEM: ≥ 7.1.0, < 7.4.12
Update to 7.4.12
symfony/security-http Packagist
- Versions
- v8.0.0
- v8.0.1
- v8.0.11
- v8.0.3
- v8.0.4
- v8.0.6
- v8.0.8
- v8.0.9
- Affected ranges
- ECOSYSTEM: ≥ 8.0.0, < 8.0.12
Update to 8.0.12
symfony/symfony Packagist
- Versions
- v7.1.0
- v7.1.1
- v7.1.10
- v7.1.11
- v7.1.2
- v7.1.3
- v7.1.4
- v7.1.5
- v7.1.6
- v7.1.7
- v7.1.8
- v7.1.9
- v7.2.0
- v7.2.0-BETA1
- v7.2.0-BETA2
- v7.2.0-RC1
- v7.2.1
- v7.2.2
- v7.2.3
- v7.2.4
- v7.2.5
- v7.2.6
- v7.2.7
- v7.2.8
- v7.2.9
- v7.3.0
- v7.3.0-BETA1
- v7.3.0-BETA2
- v7.3.0-RC1
- v7.3.1
- v7.3.10
- v7.3.11
- v7.3.2
- v7.3.3
- v7.3.4
- v7.3.5
- v7.3.6
- v7.3.7
- v7.3.8
- v7.3.9
- v7.4.0
- v7.4.0-BETA1
- v7.4.0-BETA2
- v7.4.0-RC1
- v7.4.0-RC2
- v7.4.0-RC3
- v7.4.1
- v7.4.10
- v7.4.11
- v7.4.2
- v7.4.3
- v7.4.4
- v7.4.5
- v7.4.6
- v7.4.7
- v7.4.8
- v7.4.9
- Affected ranges
- ECOSYSTEM: ≥ 7.1.0, < 7.4.12
Update to 7.4.12
symfony/symfony Packagist
- Versions
- v8.0.0
- v8.0.1
- v8.0.10
- v8.0.11
- v8.0.2
- v8.0.3
- v8.0.4
- v8.0.5
- v8.0.6
- v8.0.7
- v8.0.8
- v8.0.9
- Affected ranges
- ECOSYSTEM: ≥ 8.0.0, < 8.0.12
Update to 8.0.12
symfony Ubuntu:16.04:LTS
- Versions
- 2.7.1+dfsg-1
- 2.7.5+dfsg-1
- 2.7.9+dfsg-1
- 2.7.9+dfsg-1ubuntu2
- 2.7.10-0ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:18.04:LTS
- Versions
- 2.8.7+dfsg-1.3ubuntu1
- 3.4.3+dfsg-1ubuntu4
- 3.4.6+dfsg-1
- 3.4.6+dfsg-1ubuntu0.1
- 3.4.6+dfsg-1ubuntu0.1+esm1
- 3.4.6+dfsg-1ubuntu0.1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:20.04:LTS
- Versions
- 4.3.4+dfsg-1ubuntu1
- 4.3.8+dfsg-1ubuntu1
- 4.3.8+dfsg-1ubuntu1+esm1
- 4.3.8+dfsg-1ubuntu1+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:22.04:LTS
- Versions
- 5.2.6+dfsg-1ubuntu7
- 5.4.4+dfsg-1ubuntu8
- 5.4.4+dfsg-1ubuntu8+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:Pro:24.04:LTS
- Versions
- 5.4.23+dfsg-1ubuntu1
- 5.4.35+dfsg-3ubuntu1
- 6.4.5+dfsg-3ubuntu2
- 6.4.5+dfsg-3ubuntu3
- 6.4.5+dfsg-3ubuntu3+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:25.10
- Versions
- 6.4.18+dfsg-1ubuntu1
- 6.4.21+dfsg-2
- 6.4.21+dfsg-2ubuntu1
- 6.4.24+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:26.10
- Versions
- 7.4.7+dfsg-1ubuntu1
- 7.4.9+dfsg-1ubuntu1
- 7.4.13+dfsg-2ubuntu1
- 7.4.14+dfsg-1ubuntu2
- 7.4.15+dfsg-2ubuntu2
- 7.4.16+dfsg-1ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
symfony Ubuntu:26.04:LTS
- Versions
- 6.4.24+dfsg-1
- 7.4.5+dfsg-1ubuntu1
- 7.4.6+dfsg-2ubuntu1
- 7.4.7+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/symfony/symfony/security/advisories/GHSA-j8gj-9rm5-4xhx
- https://github.com/symfony/symfony/commit/5ba145dba702404801bdf9e7e8d6df170060d541
- https://github.com/symfony/symfony/releases/tag/v7.4.12
- https://github.com/symfony/symfony/releases/tag/v8.0.12
- https://nvd.nist.gov/vuln/detail/CVE-2026-45074