AIKIDO-2025-10153
nelmio/security-bundle is vulnerable to Open Redirect
31
Low Risk
This Affects:
nelmio/security-bundleTL;DR
Affected versions of this package are vulnerable to an open redirect due to inconsistencies in how Symfony's Request class parses URIs with special characters compared to browsers. This discrepancy allows an attacker to bypass validation and redirect users to unintended domains. The vulnerability is addressed in this patch by fixing ExternalRedirectListener to properly handle malformed URLs.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
nelmio/security-bundle is vulnerable to Open Redirect in versions 1.0.0 - 3.4.2.
How to fix this
Upgrade the nelmio/security-bundle library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant