CVE-2026-45075: Symfony Auth Bypass Vulnerability

CVE-2026-45075 Overview

CVE-2026-45075 is an authorization bypass vulnerability in the Symfony PHP framework. The flaw affects method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes when configured for the GET HTTP method only. Symfony routes HEAD requests to the GET handler, but the associated attribute check is skipped during that dispatch. Attackers can invoke protected controllers using HEAD requests, causing the controller logic to execute and leak response headers or trigger side effects without passing authorization, signature, or CSRF validation. The issue is fixed in Symfony 7.4.12 and 8.0.12. The weakness is classified as CWE-863: Incorrect Authorization.

Critical Impact
Unauthenticated remote attackers can bypass method-scoped security attributes by substituting HEAD for GET, executing protected controller code and exposing sensitive response headers.

Affected Products

Symfony versions prior to 7.4.12
Symfony versions prior to 8.0.12
Applications using method-scoped #[IsGranted], #[IsSignatureValid], or #[IsCsrfTokenValid] attributes restricted to GET

Discovery Timeline

2026-07-14 - CVE-2026-45075 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-45075

Vulnerability Analysis

Symfony provides PHP attributes such as #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] that developers apply to controller methods to enforce authorization, URL signature validation, and CSRF protection. These attributes accept an HTTP method scope, letting developers restrict enforcement to specific verbs, for example GET. Symfony's HTTP kernel follows the HTTP specification by routing HEAD requests to the same controller as the corresponding GET route. The framework strips the response body before returning the response.

The defect lies in the attribute enforcement layer. When a controller is invoked through a HEAD request, the attribute listeners compare the incoming method against the configured scope and treat HEAD as distinct from GET. The check is then skipped, and the controller executes without any authorization, signature, or CSRF validation. Attackers reach protected controller code paths and observe response headers, cache entries, and any side effects performed inside the handler.

Root Cause

The root cause is inconsistent HTTP method handling between the routing layer and the security attribute enforcement layer. Routing normalizes HEAD to GET, but the attribute checks compare against the raw request method. This mismatch produces an authorization gap that violates the developer's declared security policy.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends a HEAD request to a URL served by a controller protected by a method-scoped GET attribute. The controller executes and returns headers, which may include Location redirects, cache keys, tokens embedded in headers, or evidence of state-changing operations performed inside the handler. Detailed information appears in the Symfony GHSA-6439-2f28-8p8q advisory.

Detection Methods for CVE-2026-45075

Indicators of Compromise

Unexpected HEAD requests in web server access logs targeting endpoints that normally receive GET traffic from browsers
Elevated HEAD request volume against controllers annotated with #[IsGranted], #[IsSignatureValid], or #[IsCsrfTokenValid]
Successful 2xx or 3xx responses to HEAD requests on endpoints that should require authorization

Detection Strategies

Audit application source code for method-scoped security attributes limited to GET and enumerate the routes they protect
Correlate HEAD request logs against the enumerated route list to identify suspicious probing
Compare application response headers returned to HEAD versus authenticated GET requests to detect information leakage

Monitoring Recommendations

Ingest web server and reverse proxy logs into a centralized analytics platform and alert on anomalous HEAD request patterns
Monitor for state-changing side effects such as database writes or outbound calls originating from handlers invoked by HEAD requests
Track Symfony framework versions across the estate to identify hosts running versions prior to 7.4.12 or 8.0.12

How to Mitigate CVE-2026-45075

Immediate Actions Required

Upgrade Symfony to 7.4.12 or 8.0.12 or later on every affected application
Inventory controllers using method-scoped #[IsGranted], #[IsSignatureValid], or #[IsCsrfTokenValid] attributes and review them for exposure
Rotate any secrets, signed URLs, or CSRF tokens that may have been exposed through HEAD response headers

Patch Information

The Symfony maintainers released fixes in Symfony v7.4.12 and Symfony v8.0.12. The patch aligns attribute enforcement with routing behavior so that HEAD requests are subjected to the same checks as the corresponding GET route. Details are documented in the GitHub Security Advisory GHSA-6439-2f28-8p8q.

Workarounds

Add HEAD to the method scope of affected security attributes, for example #[IsGranted(..., methods: ['GET', 'HEAD'])]
Block or reject HEAD requests to sensitive routes at the reverse proxy or web application firewall until patching is complete
Remove method scoping from security attributes so the check applies to all HTTP methods

bash

# Upgrade Symfony via Composer to a patched release
composer require symfony/symfony:^7.4.12
# or, for the 8.x branch
composer require symfony/symfony:^8.0.12

# Verify the installed version
php bin/console --version