CVE-2026-45063: Symfony Auth Bypass Vulnerability

CVE-2026-45063 Overview

CVE-2026-45063 is an authentication bypass vulnerability in the Symfony PHP framework's X509Authenticator component. The flaw exists in how the authenticator parses the client certificate's distinguished name (DN) supplied via $_SERVER['SSL_CLIENT_S_DN']. An unanchored regular expression matches emailAddress= anywhere in the DN string, including inside other Relative Distinguished Name (RDN) values such as CN. An attacker holding any trusted certificate can embed emailAddress=victim@example.com inside another RDN field and authenticate as the victim user. The issue affects Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
Any attacker with a valid client certificate trusted by the server can impersonate arbitrary users authenticated via X.509 certificates, resulting in full account takeover.

Affected Products

Symfony versions prior to 5.4.52
Symfony versions prior to 6.4.40 and 7.4.12
Symfony versions prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45063 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45063

Vulnerability Analysis

The vulnerability resides in src/Symfony/Component/Security/Http/Authenticator/X509Authenticator.php. The authenticator extracts a user identifier from the client certificate's subject DN passed by the web server through the SSL_CLIENT_S_DN server variable. Symfony uses a regular expression to locate the emailAddress attribute and treats its value as the authenticated username.

The original regex #emailAddress=([^,/@]++@[^,/]++)# is not anchored to an RDN boundary. Because DN attribute values can legitimately contain the substring emailAddress=, the regex greedily matches that substring inside an unrelated attribute value. This produces a mismatch between the trusted certificate subject and the identifier consumed by the authentication layer.

The weakness is classified as [CWE-290] Authentication Bypass by Spoofing.

Root Cause

DN parsing is performed with a substring pattern rather than a structured parser or an anchored expression. An attacker who obtains any certificate signed by the trusted CA, for example one whose CN field contains the literal string emailAddress=victim@example.com, causes the authenticator to return the victim's email as the authenticated user identifier.

Attack Vector

Exploitation requires the attacker to enroll or obtain a client certificate from a CA that the target Symfony application trusts for X.509 authentication. The attacker sets a controlled RDN, typically CN, to a value containing emailAddress=<victim>@<domain>. When the reverse proxy or web server forwards the parsed DN in SSL_CLIENT_S_DN, Symfony's regex extracts the victim identifier and authenticates the session as that user.

php

            $username = $request->server->get($this->userKey);
        } elseif (
            $request->server->has($this->credentialsKey)
-            && preg_match('#emailAddress=([^,/@]++@[^,/]++)#', $request->server->get($this->credentialsKey), $matches)
+            && preg_match('#(?:^|[,/])\s*(?:emailAddress|1\.2\.840\.113549\.1\.9\.1)=([^,/@]++@[^,/]++)#', $request->server->get($this->credentialsKey), $matches)
        ) {
            $username = $matches[1];
        }

Source: Symfony security patch commit 59ef484. The fix anchors the match to the start of the string or a preceding , or / separator and additionally accepts the OID form 1.2.840.113549.1.9.1.

Detection Methods for CVE-2026-45063

Indicators of Compromise

Successful X.509 authentication events where the resolved username does not match the certificate's canonical subject CN or emailAddress attribute
Client certificates whose subject DN contains the literal substring emailAddress= embedded inside another RDN value such as CN, OU, or O
Authentication sessions originating from newly issued or previously unused client certificates that immediately assume high-privilege user identities

Detection Strategies

Parse SSL_CLIENT_S_DN values from web server or reverse proxy logs and flag entries where emailAddress= occurs anywhere other than at an RDN boundary
Compare the certificate serial number and issuer against the account resolved by Symfony to identify impersonation attempts
Correlate authentication events with certificate issuance records to detect newly minted certificates used for privileged access

Monitoring Recommendations

Enable verbose logging on the Symfony security firewall to capture the identifier extracted by X509Authenticator alongside the raw DN
Alert on any DN string that contains multiple emailAddress= tokens within a single subject
Review CA issuance policies and log all client certificate enrollments for review against expected user attributes

How to Mitigate CVE-2026-45063

Immediate Actions Required

Upgrade Symfony to a fixed release: 5.4.52, 6.4.40, 7.4.12, or 8.0.12
Audit issued client certificates for subject DNs containing emailAddress= inside CN, OU, O, or other RDN values and revoke any suspicious certificates
Review recent authentication logs on applications using X509Authenticator for identity mismatches

Patch Information

The fix is delivered in Symfony releases v5.4.52, v6.4.40, v7.4.12, and v8.0.12. Full details are documented in the GitHub Security Advisory GHSA-ph86-p8f6-f9r2. The patch anchors the emailAddress regex to an RDN boundary and additionally recognizes the OID 1.2.840.113549.1.9.1.

Workarounds

Restrict certificate issuance to a tightly controlled CA and enforce strict subject templates that reject user-supplied CN values containing = characters
Configure the reverse proxy to sanitize or reject client certificates whose subject DN contains emailAddress= outside a valid RDN boundary before forwarding to Symfony
Where possible, switch the Symfony firewall to consume the dedicated SSL_CLIENT_S_DN_Email server variable instead of parsing the full DN

bash

# Composer upgrade example
composer require symfony/security-http:^7.4.12
# Or for the 6.4 LTS branch
composer require symfony/security-http:^6.4.40