AIKIDO-2026-11002
symfony/security-core is vulnerable to Deserialization of Untrusted Data
68
Medium Risk
This Affects:
symfony/security-coreTL;DR
The AbstractToken base class for Symfony authentication tokens kept a legacy Serializable compatibility path that called PHP unserialize() on inner serialized data without class restrictions. An attacker who can supply a forged legacy C:-format token payload can trigger instantiation of arbitrary PHP objects during token restoration, including common deserialization gadget chains. Applications that store security tokens in sessions or other attacker-influenced serialized stores are at risk while this path exists. The fix removes the legacy Serializable implementation and the nested unserialize() call so only the modern __serialize/__unserialize format is supported.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/security-core is vulnerable to Deserialization of Untrusted Data in versions 6.4.0 - 6.4.40, 7.4.0 - 7.4.12 and 8.0.0 - 8.0.12.
How to fix this
Upgrade the symfony/security-core and/or the symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant