AIKIDO-2026-10998
symfony/security-http is vulnerable to Incorrect Authorization
75
High Risk
This Affects:
symfony/security-httpTL;DR
When a firewall uses failure_forward: true, DefaultAuthenticationFailureHandler forwards failed login attempts via an internal subrequest. Before the fix, a request-supplied _failure_path could aim that subrequest at any in-app URL. Symfony skips firewall and access_control checks on subrequests, so an unauthenticated attacker could read protected GET routes such as admin exports. The fix ignores user-supplied _failure_path during forward and always uses the configured failure path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/security-http is vulnerable to Incorrect Authorization in versions 0.0.1 - 5.4.52, 6.0.0 - 6.4.40, 7.0.0 - 7.4.12 and 8.0.0 - 8.0.12.
How to fix this
Upgrade the symfony/security-http and/or the symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant