CVE-2026-45063

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45063

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45063.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45063

Aliases

GHSA-ph86-p8f6-f9r2

Downstream

Published

2026-07-14T18:28:22Z

Modified

2026-10-22T02:49:06Z

Severity

9.1 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator

Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-290"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45063.json"
}

References

Affected packages

Git / github.com/symfony/symfony

Affected ranges

Type

GIT

Repo

https://github.com/symfony/symfony

Events

Introduced

Fixed

eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f

Introduced

aa4e97099b5a67bdc9f2387fe8d099f5c712f81c

Fixed

95a951788e30c45356278f4e4472cbbf552d0eb9

Introduced

d78c5f403d7ee794993660b1d5155536edd36fc1

Fixed

275f5cbccbcc50205206f05e599c4f57009aadb8

Introduced

2e913a829cfbbf9cb38b321bdff1806b44b192eb

Fixed

06d3b2c9a8aeb5d8493738cc51e24f6a1215827c

Fixed

59ef484029601a7af06f5e06c6ed921fdcea5a0d

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.4.52"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "6.0.0"
                },
                {
                    "fixed":  "6.4.40"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "7.0.0"
                },
                {
                    "fixed":  "7.4.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "8.0.0"
                },
                {
                    "fixed":  "8.0.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "59ef484029601a7af06f5e06c6ed921fdcea5a0d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v5.4.52",
            "range":  [
                {
                    "fixed":  "eabc5f9ed7831fe6de8d609c5ebc29aed1f8ef8f"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v6.4.40",
            "range":  [
                {
                    "fixed":  "95a951788e30c45356278f4e4472cbbf552d0eb9"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v7.4.12",
            "range":  [
                {
                    "fixed":  "275f5cbccbcc50205206f05e599c4f57009aadb8"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "v8.0.12",
            "range":  [
                {
                    "fixed":  "06d3b2c9a8aeb5d8493738cc51e24f6a1215827c"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

v2.*

v2.0.0

v2.0.0-RC1

v2.0.0-RC2

v2.0.0-RC3

v2.0.0-RC4

v2.0.0-RC5

v2.0.0-RC6

v2.0.0BETA1

v2.0.0BETA2

v2.0.0BETA3

v2.0.0BETA4

v2.0.0BETA5

v2.0.0PR8

v2.1.0

v2.1.0-BETA1

v2.1.0-BETA2

v2.1.0-BETA3

v2.1.0-BETA4

v2.1.0-RC1

v2.1.0-RC2

v2.2.0-BETA1

v2.2.0-BETA2

v2.3.0-BETA1

v2.3.0-BETA2

v2.4.0-BETA1

v2.4.0-BETA2

v2.5.0-BETA1

v2.5.0-BETA2

v2.6.0-BETA1

v3.*

v3.0.0

v3.0.0-BETA1

v3.2.0-BETA1

v3.2.0-RC1

v3.3.0-BETA1

v4.*

v4.0.0-BETA1

v4.0.0-BETA2

v4.0.0-BETA3

v4.0.0-BETA4

v4.2.0-BETA1

v4.2.0-BETA2

v4.3.0-BETA1

v5.*

v5.0.0-BETA1

v5.0.0-BETA2

v5.0.0-RC1

v5.1.0-BETA1

v5.2.0-BETA1

v5.2.0-BETA2

v5.2.0-BETA3

v5.3.0-BETA1

v5.3.0-BETA2

v5.3.0-BETA3

v5.3.0-BETA4

v5.4.0

v5.4.0-BETA1

v5.4.0-BETA2

v5.4.0-BETA3

v5.4.0-RC1

v5.4.1

v5.4.10

v5.4.11

v5.4.12

v5.4.13

v5.4.14

v5.4.15

v5.4.16

v5.4.17

v5.4.18

v5.4.19

v5.4.2

v5.4.20

v5.4.21

v5.4.22

v5.4.23

v5.4.24

v5.4.25

v5.4.26

v5.4.27

v5.4.28

v5.4.29

v5.4.3

v5.4.30

v5.4.31

v5.4.32

v5.4.33

v5.4.34

v5.4.35

v5.4.36

v5.4.37

v5.4.38

v5.4.39

v5.4.4

v5.4.40

v5.4.41

v5.4.42

v5.4.43

v5.4.44

v5.4.45

v5.4.46

v5.4.47

v5.4.48

v5.4.49

v5.4.5

v5.4.50

v5.4.51

v5.4.6

v5.4.7

v5.4.8

v5.4.9

v6.*

v6.0.0-BETA1

v6.0.0-BETA2

v6.0.0-BETA3

v6.0.0-RC1

v6.1.0-BETA1

v6.1.0-BETA2

v6.1.0-RC1

v6.2.0-BETA1

v6.2.0-BETA2

v6.2.0-BETA3

v6.3.0-BETA1

v6.3.0-BETA2

v6.3.0-BETA3

v6.3.0-RC1

v6.4.0

v6.4.0-BETA1

v6.4.0-BETA2

v6.4.0-BETA3

v6.4.0-RC1

v6.4.0-RC2

v6.4.1

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

v6.4.15

v6.4.16

v6.4.17

v6.4.18

v6.4.19

v6.4.2

v6.4.20

v6.4.21

v6.4.22

v6.4.23

v6.4.24

v6.4.25

v6.4.26

v6.4.27

v6.4.28

v6.4.29

v6.4.3

v6.4.30

v6.4.31

v6.4.32

v6.4.33

v6.4.34

v6.4.35

v6.4.36

v6.4.37

v6.4.38

v6.4.39

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v7.*

v7.0.0-BETA1

v7.0.0-BETA2

v7.0.0-BETA3

v7.0.0-RC1

v7.1.0-BETA1

v7.1.0-RC1

v7.2.0-BETA1

v7.2.0-BETA2

v7.2.0-RC1

v7.3.0-BETA1

v7.3.0-BETA2

v7.3.0-RC1

v7.4.0

v7.4.0-BETA1

v7.4.0-BETA2

v7.4.0-RC1

v7.4.0-RC2

v7.4.0-RC3

v7.4.1

v7.4.10

v7.4.11

v7.4.2

v7.4.3

v7.4.4

v7.4.5

v7.4.6

v7.4.7

v7.4.8

v7.4.9

v8.*

v8.0.0

v8.0.1

v8.0.10

v8.0.11

v8.0.2

v8.0.3

v8.0.4

v8.0.5

v8.0.6

v8.0.7

v8.0.8

v8.0.9

Other

vPR3

vPR4

vPR5

vPR6

vPR8

vPR9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45063.json"