CVE-2024-36611: Symfony Auth Bypass Vulnerability

CVE-2024-36611 Overview

CVE-2024-36611 is a disputed vulnerability reported against Symfony v7.0.7. The issue concerns the FormLoginAuthenticator component and how it handles login requests where the username or password field is empty. According to the original report, this behavior could enable improper authentication logic handling or contribute to denial-of-service conditions. The vulnerability is categorized under [CWE-863]: Incorrect Authorization.

The Symfony maintainers have reviewed the report and concluded that this is a false report. Application owners running Symfony 7.x should still validate authentication input handling, but no upstream patch was deemed necessary by the supplier.

Critical Impact
A network-accessible attacker could submit crafted login requests with empty credential fields, potentially triggering availability impact in affected Symfony applications. The Symfony project disputes the finding.

Affected Products

Symfony Framework v7.0.7
Applications using the Symfony\Component\Security\Http\Authenticator\FormLoginAuthenticator class
Web applications relying on Symfony's form-based login flow

Discovery Timeline

2024-11-29 - CVE-2024-36611 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database following supplier dispute

Technical Details for CVE-2024-36611

Vulnerability Analysis

The reported flaw resides in Symfony's FormLoginAuthenticator, which authenticates users submitting login forms. The reporter observed that when either the username or password field is empty in a submitted request, the component does not adequately reject the request before proceeding through authentication logic. This behavior, per the report, may lead to inconsistent authentication handling or resource consumption when many such requests are received.

The vulnerability is classified as a network-exploitable issue impacting availability rather than confidentiality or integrity. The Symfony maintainers reviewed the report at Symfony Issue 59077 and concluded the framework's existing handling is correct. A related code change is referenced in the Symfony Commit Update.

Root Cause

The reporter identified the relevant logic at line 132 of FormLoginAuthenticator.php in the Symfony 7.0.7 tag. See the Symfony Authenticator Code for the specific implementation. The dispute centers on whether downstream authentication providers, rather than the authenticator itself, are responsible for rejecting empty credentials.

Attack Vector

An unauthenticated remote attacker would submit HTTP POST requests to the application's login endpoint with empty username or password fields. Refer to the proof-of-concept at the GitHub Gist PoC and the discussion in the GitHub Security Advisory. No authentication or user interaction is required to trigger the reported behavior.

No verified exploitation code is published for this CVE. The vulnerability mechanism is described in the linked references.

Detection Methods for CVE-2024-36611

Indicators of Compromise

High-volume POST requests to Symfony login endpoints (commonly /login or /login_check) containing empty _username or _password form fields.
Anomalous spikes in failed authentication events originating from a small set of source IP addresses.
Application logs showing repeated FormLoginAuthenticator invocations without corresponding successful or failed user lookups.

Detection Strategies

Inspect web server access logs for POST requests to login routes where body parameters contain empty credential fields.
Correlate Symfony security event logs with web application firewall telemetry to identify automated credential submission patterns.
Monitor PHP-FPM and application worker processes for sustained CPU or memory pressure during authentication bursts.

Monitoring Recommendations

Enable Symfony's security event logging at the info level for the firewall handling form login.
Add WAF rules that reject login POST requests missing required credential fields before they reach the application.
Track per-IP request rates against login endpoints and alert on thresholds consistent with credential stuffing or DoS probing.

How to Mitigate CVE-2024-36611

Immediate Actions Required

Review the Symfony maintainers' dispute in the Symfony Issue Comment before scheduling emergency change windows.
Apply input validation in your login controller or form type to reject submissions with empty _username or _password values.
Enforce rate limiting on login endpoints using Symfony's built-in login_throttling firewall option.

Patch Information

The Symfony project has concluded that this is a false report and has not released a security patch specifically tied to CVE-2024-36611. A related code change appears in commit a804ca15fcad279d7727b91d12a667fd5b925995. Operators should track upstream Symfony releases through official channels and apply general security updates as they ship.

Workarounds

Configure login_throttling in security.yaml to limit authentication attempts per IP and per username.
Add a NotBlank constraint on username and password fields in the login form type to reject empty submissions at the form layer.
Deploy a WAF rule that blocks login POST requests containing empty required parameters before they reach PHP.

bash

# Configuration example: enable login throttling in Symfony security.yaml
security:
    firewalls:
        main:
            login_throttling:
                max_attempts: 5
                interval: '1 minute'