GHSA-29fc-p6c4-24cg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-29fc-p6c4-24cg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-29fc-p6c4-24cg/GHSA-29fc-p6c4-24cg.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-29fc-p6c4-24cg
- Aliases
-
- CVE-2026-45069
- Published
- 2026-05-27T21:03:36Z
- Modified
- 2026-05-27T21:15:09.524708260Z
- Severity
-
- 4.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
- Details
-
Description
OidcTokenHandleris Symfony's built-in access-token handler for OpenID Connect: it validates a bearer JWT and returns the authenticated user identity. It delegates claim validation to theweb-token/jwt-checkerlibrary'sClaimCheckerManager.OidcTokenHandler::verifyClaims()registers audience (aud), issuer (iss), and expiry (exp) checkers, but never passes the$mandatoryClaimsargument toClaimCheckerManager::check(). That method only validates claims that are present in the token: a checker for an absent claim is silently skipped. A validly-signed JWT that simply omitsaud,iss, andexptherefore passes verification.Resolution
The
OidcTokenHandlernow calls theClaimCheckerManagerwith the list of mandatory claims so that tokens missingaud,iss, orexpare rejected.The patch for this issue is available here for branch 6.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-345", "CWE-1287" ], "github_reviewed": true, "github_reviewed_at": "2026-05-27T21:03:36Z", "nvd_published_at": null, "severity": "MODERATE" }- References
-
- https://github.com/symfony/symfony/security/advisories/GHSA-29fc-p6c4-24cg
- https://github.com/symfony/symfony/commit/6b717aaac21b7e96798448d14c4355ea87690b3d
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45069.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45069.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45069
Affected packages
Packagist
symfony/security-http
Package
- Name
- symfony/security-http
- Purl
- pkg:composer/symfony%2Fsecurity-http
Affected versions
v6.*
symfony/security-http
Package
- Name
- symfony/security-http
- Purl
- pkg:composer/symfony%2Fsecurity-http
symfony/security-http
Package
- Name
- symfony/security-http
- Purl
- pkg:composer/symfony%2Fsecurity-http
symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony%2Fsymfony