AIKIDO-2026-10884
symfony/security-http is vulnerable to Authentication Bypass by Spoofing
81
High Risk
This Affects:
symfony/security-httpTL;DR
Cas2Handler builds its CAS service URL from the incoming request host. Without trusted host configuration, the host can be attacker controlled and can change the service value sent to CAS validation. Pre-fix applications can be exposed to cross-service ticket replay when another service shares the same CAS server. The fix requires an explicit service URL instead of deriving it from the request host.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/security-http is vulnerable to Authentication Bypass by Spoofing in versions 7.1.0 - 7.4.11 and 8.0.0 - 8.0.11.
How to fix this
Upgrade the symfony/security-http and/or symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant