GHSA-j8gj-9rm5-4xhx
Suggest an improvement- Source
- https://github.com/advisories/GHSA-j8gj-9rm5-4xhx
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-j8gj-9rm5-4xhx/GHSA-j8gj-9rm5-4xhx.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-j8gj-9rm5-4xhx
- Aliases
-
- CVE-2026-45074
- Published
- 2026-05-27T21:11:59Z
- Modified
- 2026-05-27T21:30:09.331498804Z
- Severity
-
- 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
- Summary
- Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
- Details
-
Cas2Handlerbuilds thisserviceparameter fromRequest::getSchemeAndHttpHost(), which reflects the attacker-controlled HTTPHostheader whenever Symfony'sframework.trusted_hostssetting is not configured (the default). An attacker who controls any other application registered with the same CAS server can replay a victim's ticket against the Symfony application, with a spoofedHostheader, and be authenticated as that victim.Resolution
A new required
service_urlconfiguration option is introduced onCas2Handler. The CASserviceparameter sent to the validation endpoint is now built from this configured URL instead of being derived from the request'sHostheader, preventing cross-service ticket replay via Host header spoofing.The patch for this issue is available here for branch 7.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Nicolas Grekas for providing the fix.
- Database specific
{ "cwe_ids": [ "CWE-290" ], "github_reviewed": true, "nvd_published_at": null, "github_reviewed_at": "2026-05-27T21:11:59Z", "severity": "MODERATE" }- References
-
- https://github.com/symfony/symfony/security/advisories/GHSA-j8gj-9rm5-4xhx
- https://github.com/symfony/symfony/commit/5ba145dba702404801bdf9e7e8d6df170060d541
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45074.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45074.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45074
Affected packages
Packagist / symfony/security-http
Package
- Name
- symfony/security-http
- Purl
- pkg:composer/symfony%2Fsecurity-http
Affected versions
v7.*
Packagist / symfony/security-http
Package
- Name
- symfony/security-http
- Purl
- pkg:composer/symfony%2Fsecurity-http
Packagist / symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony%2Fsymfony
Affected versions
v7.*
Packagist / symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony%2Fsymfony