CVE-2019-10911
Improper authentication in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
- Record
CVE-2019-10911- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
- Record
CVE-2019-10911- Updated
- 2026-11-02
EUVDEUVD-2020-0300 No score
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
- Record
EUVD-2020-0300- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cchx-mfrc-fwqr
Improper authentication in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
- Record
GHSA-cchx-mfrc-fwqr- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200, CWE-287
- Updated
- 2026-11-02
OSV
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
- Record
CVE-2019-10911- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-10911
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
- Record
DEBIAN-CVE-2019-10911- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-cchx-mfrc-fwqr
Improper authentication in Symfony
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
- Record
GHSA-cchx-mfrc-fwqr- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-200, CWE-287
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-10911
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
- Record
UBUNTU-CVE-2019-10911- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/security-httpPackagist |
2.7.0 up to 2.7.51 | 2.7.51 |
symfony/security-httpPackagist |
2.8.0 up to 2.8.50 | 2.8.50 |
symfony/security-httpPackagist |
3.0.0 up to 3.4.26 | 3.4.26 |
symfony/security-httpPackagist |
4.0.0 up to 4.1.12 | 4.1.12 |
symfony/security-httpPackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
symfony/securityPackagist |
2.7.0 up to 2.7.51 | 2.7.51 |
symfony/securityPackagist |
2.8.0 up to 2.8.50 | 2.8.50 |
symfony/securityPackagist |
3.0.0 up to 3.4.26 | 3.4.26 |
symfony/securityPackagist |
4.0.0 up to 4.1.12 | 4.1.12 |
symfony/securityPackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/symfonyPackagist |
2.7.0 up to 2.7.51 | 2.7.51 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.50 | 2.8.50 |
symfony/symfonyPackagist |
3.0.0 up to 3.4.26 | 3.4.26 |
symfony/symfonyPackagist |
4.0.0 up to 4.1.12 | 4.1.12 |
symfony/symfonyPackagist |
4.2.0 up to 4.2.7 | 4.2.7 |
symfonyDebian:12 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:13 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:14 |
before 3.4.22+dfsg-2 | 3.4.22+dfsg-2 |
symfonyDebian:8 From an advisory covering 4 CVEs |
before 2.3.21+dfsg-4+deb8u5, plus listed versions 2.3.21+dfsg-42.3.21+dfsg-4+deb8u12.3.21+dfsg-4+deb8u22.3.21+dfsg-4+deb8u32.3.21+dfsg-4+deb8u4 |
2.3.21+dfsg-4+deb8u5 |
symfonyDebian:9 From an advisory covering 8 CVEs |
before 2.8.7+dfsg-1.3+deb9u2, plus listed versions 2.8.7+dfsg-1.32.8.7+dfsg-1.3+deb9u1 |
2.8.7+dfsg-1.3+deb9u2 |
symfony/security-httpPackagist |
2.7.0 up to 2.7.51, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 45 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8 |
2.7.51 |
symfony/security-httpPackagist |
2.8.0 up to 2.8.50, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.50 |
symfony/security-httpPackagist |
3.0.0 up to 3.4.26, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.26 |
symfony/security-httpPackagist |
4.0.0 up to 4.1.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 26 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9 |
4.1.12 |
symfony/security-httpPackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
symfony/securityPackagist |
2.7.0 up to 2.7.51, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 45 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8 |
2.7.51 |
symfony/securityPackagist |
2.8.0 up to 2.8.50, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.50 |
symfony/securityPackagist |
3.0.0 up to 3.4.26, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.26 |
symfony/securityPackagist |
4.0.0 up to 4.1.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 26 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9 |
4.1.12 |
symfony/securityPackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
symfony/symfonyPackagist |
2.7.0 up to 2.7.51, plus listed versions v2.7.0v2.7.1v2.7.10v2.7.11v2.7.12 Show 45 moreShow lessv2.7.13v2.7.14v2.7.15v2.7.16v2.7.17v2.7.18v2.7.19v2.7.2v2.7.20v2.7.21v2.7.22v2.7.23v2.7.24v2.7.25v2.7.26v2.7.27v2.7.28v2.7.29v2.7.3v2.7.30v2.7.31v2.7.32v2.7.33v2.7.34v2.7.35v2.7.36v2.7.37v2.7.38v2.7.39v2.7.4v2.7.40v2.7.41v2.7.42v2.7.43v2.7.44v2.7.45v2.7.46v2.7.47v2.7.48v2.7.49v2.7.5v2.7.50v2.7.6v2.7.7v2.7.8 |
2.7.51 |
symfony/symfonyPackagist |
2.8.0 up to 2.8.50, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.6v2.8.7v2.8.8v2.8.9 |
2.8.50 |
symfony/symfonyPackagist |
3.0.0 up to 3.4.26, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4 Show 45 moreShow lessv3.0.5v3.0.6v3.0.7v3.0.8v3.0.9v3.1.0v3.1.0-BETA1v3.1.0-RC1v3.1.1v3.1.10v3.1.2v3.1.3v3.1.4v3.1.5v3.1.6v3.1.7v3.1.8v3.1.9v3.2.0v3.2.0-BETA1v3.2.0-RC1v3.2.0-RC2v3.2.1v3.2.10v3.2.11v3.2.12v3.2.13v3.2.14v3.2.2v3.2.3v3.2.4v3.2.5v3.2.6v3.2.7v3.2.8v3.2.9v3.3.0v3.3.0-BETA1v3.3.0-RC1v3.3.1v3.3.10v3.3.11v3.3.12v3.3.13v3.3.14 |
3.4.26 |
symfony/symfonyPackagist |
4.0.0 up to 4.1.12, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 26 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9 |
4.1.12 |
symfony/symfonyPackagist |
4.2.0 up to 4.2.7, plus listed versions v4.2.0v4.2.1v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6 |
4.2.7 |
symfonyUbuntu:16.04:LTS |
All versions, plus listed versions 2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2 |
None known |
symfonyUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-10911 is a high vulnerability (CVSS 7.5) in Sensiolabs Symfony, published May 6, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.21%, the 68th percentile. Fixed in symfony/security-http 2.7.51.
References
synology.com/security/advisory/Synology_SA_19_19
symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remember-me-cookie-hash
github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081
nvd.nist.gov/vuln/detail/CVE-2019-10911
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2019-10911
ubuntu.com/security/CVE-2019-10911
drupal.org/SA-CORE-2019-005
cve.org/CVERecord?id=CVE-2019-10911
Left out here: 135 versions. The JSON record has them.