AIKIDO-2026-11002
symfony/security-core is vulnerable to Deserialization of Untrusted Data
68
Medium Risk
This Affects:
symfony/security-coreTL;DR
The AbstractToken base class for Symfony authentication tokens kept a legacy Serializable compatibility path that called PHP unserialize() on inner serialized data without class restrictions. An attacker who can supply a forged legacy C:-format token payload can trigger instantiation of arbitrary PHP objects during token restoration, including common deserialization gadget chains. Applications that store security tokens in sessions or other attacker-influenced serialized stores are at risk while this path exists. The fix removes the legacy Serializable implementation and the nested unserialize() call so only the modern __serialize/__unserialize format is supported.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/security-core is vulnerable to Deserialization of Untrusted Data in versions 6.4.0 - 6.4.40, 7.4.0 - 7.4.12 and 8.0.0 - 8.0.12.
How to fix this
Upgrade the symfony/security-core and/or the symfony/symfony library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.