CVE-2026-45069

EUVD-2026-44357

14.07.2026, 19:17

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.1 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 17.13%

Affected Products (NVD)

Vendor	Product	Version
sensiolabs	symfony	6.3.0 ≤ 𝑥 < 6.4.40
sensiolabs	symfony	7.4.0 ≤ 𝑥 < 7.4.12
sensiolabs	symfony	8.0.0 ≤ 𝑥 < 8.0.12

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

symfony

bookworm	5.4.53+dfsg-0+deb12u1 fixed
bookworm (security)	5.4.53+dfsg-0+deb12u1 fixed
bullseye	vulnerable
bullseye (security)	vulnerable
forky	7.4.16+dfsg-1 fixed
sid	7.4.17+dfsg-1 fixed
trixie	6.4.41+dfsg-0+deb13u1 fixed
trixie (security)	6.4.41+dfsg-0+deb13u1 fixed

Ubuntu Releases

Ubuntu Product

Codename

symfony

bionic	needs-triage
focal	needs-triage
jammy	needs-triage
noble	needs-triage
questing	ignored
resolute	needs-triage
xenial	needs-triage

Common Weakness Enumeration

CWE-345 - Insufficient Verification of Data Authenticity
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References

https://github.com/symfony/symfony/releases/tag/v6.4.40

https://github.com/symfony/symfony/releases/tag/v7.4.12

https://github.com/symfony/symfony/releases/tag/v8.0.12

https://github.com/symfony/symfony/security/advisories/GHSA-29fc-p6c4-24cg