CVE-2026-45074: Symfony Auth Bypass Vulnerability

CVE-2026-45074 Overview

Symfony is a PHP framework for web and console applications that provides reusable PHP components. CVE-2026-45074 affects the Cas2Handler component in the Security HTTP AccessToken subsystem. The handler builds the Central Authentication Service (CAS) service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured. An attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. The flaw exists from Symfony 7.1.0 through versions before 7.4.12 and 8.0.12.

Critical Impact
Authentication bypass allowing account takeover through CAS ticket replay when trusted hosts are not configured.

Affected Products

Symfony 7.1.0 through 7.4.11
Symfony 8.0.0 through 8.0.11
Applications using the Cas2Handler for CAS authentication without framework.trusted_hosts configured

Discovery Timeline

2026-07-14 - CVE-2026-45074 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45074

Vulnerability Analysis

The vulnerability is an authentication bypass classified under [CWE-290] (Authentication Bypass by Spoofing). The Cas2Handler class validates CAS tickets by contacting the CAS server with a service URL parameter. This parameter must exactly match the service value that was originally used to obtain the ticket. Symfony constructs this value from the incoming HTTP request scheme and host, which an attacker can manipulate through the Host header. When framework.trusted_hosts is unset, Symfony accepts any host value the client provides.

Root Cause

The root cause is trust in unvalidated client input. Request::getSchemeAndHttpHost() returns a value derived from the Host header. Without a configured trusted_hosts allowlist, the framework accepts arbitrary hosts. The CAS specification treats the service parameter as the identity of the relying application, so accepting attacker-influenced hosts breaks the trust binding between ticket, service, and authenticated principal.

Attack Vector

An attacker who controls a second application registered with the same CAS server crafts a request to the target Symfony application containing a Host header matching their own application. The victim's CAS ticket, intended for the attacker's service, is validated by the Symfony application as if it were issued for itself. The Symfony instance then authenticates the incoming session as the victim, granting session-level account takeover.

php

// Security patch in src/Symfony/Component/Security/Http/AccessToken/Cas/Cas2Handler.php
// [Security] Require configuring trusted hosts when using CAS authentication
 namespace Symfony\Component\Security\Http\AccessToken\Cas;

 use Symfony\Component\HttpClient\HttpClient;
+use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\Security\Core\Exception\AuthenticationException;
 use Symfony\Component\Security\Http\AccessToken\AccessTokenHandlerInterface;

Source: Symfony commit 5ba145d

Detection Methods for CVE-2026-45074

Indicators of Compromise

Inbound HTTP requests to CAS-protected Symfony endpoints containing a Host header that does not match the application's canonical domain
CAS ticket validation requests originating from the Symfony backend with unexpected service URL values
Session establishment events for users who did not initiate login from the Symfony application directly

Detection Strategies

Enable request logging on reverse proxies and web servers to capture the Host header for every request reaching Symfony CAS routes
Correlate CAS serviceValidate outbound requests with the Host header of the inbound triggering request to detect mismatch
Alert on authentication successes where the CAS service parameter references an unexpected hostname

Monitoring Recommendations

Monitor Symfony application logs for authentication events tied to non-canonical hostnames
Track CAS server audit logs for cross-service ticket usage patterns
Baseline the set of hostnames appearing in Host headers and alert on deviations

How to Mitigate CVE-2026-45074

Immediate Actions Required

Upgrade to Symfony 7.4.12 or 8.0.12, which contain the fix
Configure framework.trusted_hosts with an explicit allowlist of canonical hostnames
Audit all applications registered with the same CAS realm for shared trust exposure
Review recent authentication logs for anomalous Host header values

Patch Information

The fix is available in Symfony versions 7.4.12 and 8.0.12. See the GitHub Security Advisory GHSA-j8gj-9rm5-4xhx and the remediation commit. Patched releases are available at v7.4.12 and v8.0.12. After patching, Cas2Handler requires trusted hosts to be configured before it will accept requests.

Workarounds

Set framework.trusted_hosts in config/packages/framework.yaml to a regex matching only expected canonical domains
Enforce Host header validation at the reverse proxy or load balancer layer, rejecting requests with unexpected host values
Restrict CAS realm membership so that only mutually trusted applications share the same CAS server

bash

# config/packages/framework.yaml
framework:
    trusted_hosts: ['^app\.example\.com$', '^www\.example\.com$']