AIKIDO-2026-10998
symfony/security-http is vulnerable to Incorrect Authorization
75
High Risk
This Affects:
symfony/security-httpTL;DR
When a firewall uses failure_forward: true, DefaultAuthenticationFailureHandler forwards failed login attempts via an internal subrequest. Before the fix, a request-supplied _failure_path could aim that subrequest at any in-app URL. Symfony skips firewall and access_control checks on subrequests, so an unauthenticated attacker could read protected GET routes such as admin exports. The fix ignores user-supplied _failure_path during forward and always uses the configured failure path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/security-http is vulnerable to Incorrect Authorization in versions 0.0.1 - 5.4.52, 6.0.0 - 6.4.40, 7.0.0 - 7.4.12 and 8.0.0 - 8.0.12.
How to fix this
Upgrade the symfony/security-http and/or the symfony/symfony library to the patch version.
Links
GitHub Releases
github.com/symfony/symfony/releases/tag/v5.4.53github.com/symfony/symfony/releases/tag/v6.4.41github.com/symfony/symfony/releases/tag/v7.4.13
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.