CVE-2026-45069: Symfony Auth Bypass Vulnerability

CVE-2026-45069 Overview

CVE-2026-45069 is a JWT claim verification bypass affecting the Symfony PHP framework. The vulnerability resides in the OidcTokenHandler::verifyClaims() method, which registered checkers for the audience (aud), issuer (iss), and expiry (exp) claims but failed to pass the mandatory claims list to ClaimCheckerManager::check(). As a result, a validly signed JSON Web Token (JWT) that omits any or all of these claims can pass verification. The flaw is categorized under [CWE-345: Insufficient Verification of Data Authenticity]. Symfony maintainers released fixed versions 6.4.40, 7.4.12, and 8.0.12 to address the issue.

Critical Impact
Attackers can forge or reuse JWTs missing required claims to bypass OpenID Connect (OIDC) authentication and gain unauthorized access to protected Symfony applications.

Affected Products

Symfony versions prior to 6.4.40
Symfony versions prior to 7.4.12
Symfony versions prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-45069 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45069

Vulnerability Analysis

The Symfony Security component provides OIDC integration through OidcTokenHandler, which validates JWTs presented by clients during authentication. The handler registers three standard claim checkers: AudienceChecker, IssuerChecker, and ExpirationChecker. These checkers only validate claims when they are present in the token payload.

The underlying flaw is that ClaimCheckerManager::check() accepts a second argument specifying a list of mandatory claims that must exist. Symfony's verifyClaims() implementation invoked check() without passing this list. Consequently, a JWT with a valid cryptographic signature but missing aud, iss, or exp claims passed verification silently.

An attacker who obtains any validly signed token from the trusted signer, including a long-expired token or a token minted for a different audience, can strip or omit critical claims and authenticate against the target Symfony application.

Root Cause

The root cause is a missing parameter in the call to ClaimCheckerManager::check(). The web-token library treats claim checkers as conditional validators, only firing when the corresponding claim exists. Without a mandatory claims list, the manager does not enforce claim presence, allowing token forgery scenarios that bypass audience, issuer, and expiry restrictions.

Attack Vector

Exploitation requires network access to a Symfony application configured to use OidcTokenHandler for authentication. The attacker crafts a JWT signed with a key the application trusts and omits aud, iss, or exp claims. The Symfony authenticator accepts the token and establishes an authenticated session. See the GitHub Security Advisory GHSA-29fc-p6c4-24cg for full technical details.

Detection Methods for CVE-2026-45069

Indicators of Compromise

Authentication events accepting JWTs that lack exp, aud, or iss claims
Successful OIDC logins tied to tokens with issuance timestamps far in the past
Session activity originating from bearer tokens that would fail strict OIDC compliance checks

Detection Strategies

Enable verbose logging on the Symfony security channel and inspect decoded JWT payloads for missing required claims
Deploy a Web Application Firewall (WAF) rule that decodes bearer tokens on OIDC endpoints and flags payloads missing aud, iss, or exp
Compare Symfony framework versions across your inventory against the fixed releases 6.4.40, 7.4.12, and 8.0.12

Monitoring Recommendations

Alert on authentication successes for principals that have not logged in for extended periods, which may indicate replayed expired tokens
Monitor OIDC provider logs for token issuance patterns that do not match subsequent Symfony authentication events
Track deployments of Symfony packages in composer manifests and CI/CD pipelines to identify vulnerable versions in production

How to Mitigate CVE-2026-45069

Immediate Actions Required

Upgrade Symfony to 6.4.40, 7.4.12, or 8.0.12 depending on the release branch in use
Audit all Symfony applications using OidcTokenHandler for authentication and rotate any signing keys suspected of exposure
Invalidate active sessions established through OIDC to force re-authentication with the patched claim verification logic

Patch Information

The Symfony maintainers released fixes in Symfony v6.4.40, Symfony v7.4.12, and Symfony v8.0.12. The patch updates OidcTokenHandler::verifyClaims() to pass the mandatory claims list to ClaimCheckerManager::check(), enforcing the presence of aud, iss, and exp claims.

Workarounds

If immediate upgrade is not feasible, extend OidcTokenHandler and override verifyClaims() to call ClaimCheckerManager::check() with the mandatory claims array ['aud', 'iss', 'exp']
Place a reverse proxy or API gateway in front of Symfony endpoints to reject bearer tokens missing required OIDC claims
Restrict OIDC signing keys to short-lived credentials to reduce the window during which a signed but claim-stripped token remains valid

bash

# Update Symfony via Composer to a patched release
composer require symfony/security-http:^7.4.12
composer update symfony/security-http --with-dependencies

# Verify the installed version
php bin/console --version