CVE-2026-45074: Symfony Security-HTTP Package Cross-Service Ticket Replay Vulnerability
Summary
CVE-2026-45074: Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay. Affects symfony/security-http across 2 version ranges.
>= 7.1.0, < 7.4.12
>= 8.0.0, < 8.0.12
Fixed in 7.4.12 or 8.0.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework used for building web applications. The security-http component of Symfony provides tools for managing security features, including authentication and authorization. This component is crucial for ensuring that web applications are secure and that user sessions are properly managed. However, a vulnerability has been identified in the Cas2Handler class, which can lead to serious security issues if not addressed.
Vulnerability Detail
The vulnerability arises from the Cas2Handler's method of constructing the 'service' parameter using the Request::getSchemeAndHttpHost() function. This function reflects the HTTP Host header, which can be manipulated by an attacker if the framework's trusted_hosts setting is not configured. As a result, an attacker controlling another application registered with the same CAS server can replay a victim's ticket against the Symfony application, effectively impersonating the victim and gaining unauthorized access.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.1.0, < 7.4.127.4.12composer require symfony/security-http:7.4.12 -
>= 8.0.0, < 8.0.128.0.12composer require symfony/security-http:8.0.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can configure the 'framework.trusted_hosts' setting in your Symfony application to restrict the accepted Host headers. This can help mitigate the risk of this vulnerability until you can apply the patch. Example configuration in your Symfony config file: 'framework: trusted_hosts: ['^localhost$', '^yourdomain.com$']'.
Conclusion
The CVE-2026-45074 vulnerability in Symfony's security-http package poses a significant risk due to its potential for cross-service ticket replay attacks. It is crucial for developers to update their packages to the latest patched versions and configure their applications properly to mitigate this risk. Utilizing tools like Vulert can help maintain awareness of vulnerabilities in your software.
See every vulnerability recorded for symfony/security-http →
FAQ
CVE-2026-45074 is a vulnerability in the Symfony security-http package that allows attackers to replay authentication tickets by manipulating the Host header.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
If exploited, this vulnerability can allow attackers to impersonate legitimate users, leading to unauthorized access to sensitive information and functionalities within the application.
To apply the patch, update your Symfony security-http package to version 7.4.12 or 8.0.12 by running 'composer update symfony/security-http' in your project directory.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the composer.lock file, providing real-time insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-http.
