AIKIDO-2026-951952

symfony/symfony is vulnerable to Authentication Bypass Using an Alternate Path or Channel

GHSA-3H27-HJV7-FQJXPublished 4 days ago

CVE Score

Low

Authentication Bypass Using an Alternate Path or Channel

TL;DR

Before the fix, getBaseUrlReal() accepted the script name as a URL prefix even when the path continued the same segment, so with SCRIPT_NAME set to /index.php a request to /index.phpadmin was routed as /admin. An unauthenticated client able to reach the front controller could bypass path rules enforced in front of PHP, such as an nginx location block, an Apache <Location> section, or a CDN or WAF rule, while Symfony's own access_control and firewalls were not bypassed. This applied from the releases that shipped the CVE-2025-64500 path normalization (5.4.50, 6.4.29, 7.3.7, 8.0.0). The fix strips the script name only when followed by /, ? or the end of the URL, so /index.phpadmin now keeps its full path.

How do I fix this?

Upgrade the symfony/symfony package to a fixed release on your branch: 5.4.56, 6.4.50, 7.4.23, 8.1.11.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and use a front controller with a non-empty SCRIPT_NAME behind path rules enforced in front of PHP (nginx location, Apache <Location>, CDN or WAF).

Package

symfony/symfony

Versions

5.4.50 - 5.4.55

Fixed in 5.4.56

6.4.29 - 6.4.49

Fixed in 6.4.50

7.3.7 - 7.4.22

Fixed in 7.4.23

8.0.0 - 8.1.10

Fixed in 8.1.11

Background info

symfony/symfony is vulnerable to Authentication Bypass Using an Alternate Path or Channel in versions 5.4.50 - 5.4.55, 6.4.29 - 6.4.49, 7.3.7 - 7.4.22 and 8.0.0 - 8.1.10.

CVE Score

Low

Authentication Bypass Using an Alternate Path or Channel

Are you affected? Scan for Free