symfony/security-http vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-48489Highsymfony/security-http: Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes CVE-2026-45075Highsymfony/http-kernel: Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]CVE-2026-45074Mediumsymfony/security-http: Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay CVE-2026-45069Mediumsymfony/security-http: Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims CVE-2026-45063Highsymfony/security-http: Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator CVE-2024-51996Highsymfony/security-http: Symfony has an Authentication Bypass via RememberMe CVE-2023-46733Mediumsymfony/security-http: Symfony possible session fixation vulnerability CVE-2016-4423Highsymfony/security-http: Symphony Denial of Service Via Overlong Usernames CVE-2015-8125Highsymfony/symfony: Symfony Vulnerable to Timing Attack CVE-2015-8124Lowsymfony/symfony: Symfony Session Fixation Vulnerability CVE-2018-11385Highsymfony/symfony: Symfony Session Fixation Vulnerability CVE-2017-16652Mediumsymfony/symfony: Symfony Open Redirect CVE-2018-11406Highsymfony/symfony: Symfony CSRF Token Fixation CVE-2018-19790Mediumsymfony/security-http: Symfony Open Redirect CVE-2021-32693Mediumsymfony/security-http: Authentication granted to all firewalls instead of just one GHSA-G2QJ-PMXM-9F8FLowsymfony/security-http: User enumeration in authentication mechanisms CVE-2021-21424Mediumsymfony/security: Prevent user enumeration using Guard or the new Authenticator-based Security CVE-2020-5275Highsymfony/security: Firewall configured with unanimous strategy was not actually unanimous in Symfony CVE-2019-10911Highsymfony/security-http: Improper authentication in Symfony CVE-2019-18886Mediumsymfony/security-http: User enumeration leak using switch user functionality in Symfony

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo