AIKIDO-2026-656715

TL;DR

Several token and exception classes in the Symfony Security Core component restore typed string properties straight from raw serialized data inside their __unserialize() methods. Because PHP coerces objects to strings during that assignment, a forged payload that places a \Stringable object in one of those slots invokes its __toString() method before any post-assignment validation runs. When an application deserializes attacker-controlled data containing one of these classes, this __toString trampoline can drive attacker-chosen gadget logic during unserialization. The fix rejects \Stringable values in the raw data before assigning any typed string property and throws an exception instead.