Every CVE Search/ Get API key

CVE-2026-45074

Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

7.6 HighFix available

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.49%Up 0.4 points since Jun 12, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.6

Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

Record
CVE-2026-45074
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-290
Updated
2026-11-02
EUVDEUVD-2026-44338 7.6

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

Record
EUVD-2026-44338
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-j8gj-9rm5-4xhx 6.6

Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

Cas2Handler builds this service parameter from Request::getSchemeAndHttpHost(), which reflects the attacker-controlled HTTP Host header whenever Symfony's framework.trusted_hosts setting is not configured (the default). An attacker who controls any other application registered with the same CAS server can replay a victim's ticket against the Symfony application, with a spoofed Host header, and be authenticated as that victim.

Resolution

A new required service_url configuration option is introduced on Cas2Handler. The CAS service parameter sent to the validation endpoint is now built from this configured URL instead of being derived from the request's Host header, preventing cross-service ticket replay via Host header spoofing.

The patch for this issue is available here for branch 7.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Nicolas Grekas for providing the fix.

Record
GHSA-j8gj-9rm5-4xhx
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-290
Updated
2026-11-02
NVD 7.6

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

Record
CVE-2026-45074
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weakness
CWE-290
Updated
2026-11-02
OSV 7.6

Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

Record
CVE-2026-45074
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-290
Updated
2026-11-02
OSVDEBIAN-CVE-2026-45074 8.1

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

Record
DEBIAN-CVE-2026-45074
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVGHSA-j8gj-9rm5-4xhx 6.6

Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

Cas2Handler builds this service parameter from Request::getSchemeAndHttpHost(), which reflects the attacker-controlled HTTP Host header whenever Symfony's framework.trusted_hosts setting is not configured (the default). An attacker who controls any other application registered with the same CAS server can replay a victim's ticket against the Symfony application, with a spoofed Host header, and be authenticated as that victim.

Resolution

A new required service_url configuration option is introduced on Cas2Handler. The CAS service parameter sent to the validation endpoint is now built from this configured URL instead of being derived from the request's Host header, preventing cross-service ticket replay via Host header spoofing.

The patch for this issue is available here for branch 7.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Nicolas Grekas for providing the fix.

Record
GHSA-j8gj-9rm5-4xhx
CVSS 4.0
6.6 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weakness
CWE-290
Updated
2026-11-02
OSVUBUNTU-CVE-2026-45074 7.6

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

Record
UBUNTU-CVE-2026-45074
CVSS 4.0
7.6 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
symfony/security-http
Packagist
 7.1.0 up to 7.4.12
7.4.12
symfony/security-http
Packagist
 8.0.0 up to 8.0.12
8.0.12
symfony/symfony
Packagist
 7.1.0 up to 7.4.12
7.4.12
symfony/symfony
Packagist
 8.0.0 up to 8.0.12
8.0.12
symfony
Debian:14
 before 7.4.12+dfsg-1, plus listed versions
6.4.21+dfsg-26.4.24+dfsg-16.4.25+dfsg-17.0.4+dfsg-17.0.5+dfsg-1
Show 45 moreShow less
7.0.6+dfsg-17.0.7+dfsg-17.1.0~beta1+dfsg-17.1.0~rc1+dfsg-17.1.2+dfsg-17.1.3+dfsg-17.1.4+dfsg-17.1.5+dfsg-17.2.0~beta1+dfsg-17.2.0~beta2+dfsg-17.2.0~rc1+dfsg-17.2.1+dfsg-17.2.2+dfsg-17.2.3+dfsg-17.2.4+dfsg-17.2.5+dfsg-17.2.6-17.3.0+dfsg-17.3.0~beta1+dfsg-17.3.0~beta2+dfsg-17.3.0~rc1+dfsg-17.3.1+dfsg-17.3.2+dfsg-17.3.3+dfsg-17.3.4+dfsg-17.3.5-17.4.0+dfsg-17.4.0+dfsg-27.4.0~beta1-17.4.0~beta1-27.4.0~beta2+dfsg-17.4.0~beta2+dfsg-27.4.0~beta2+dfsg-37.4.0~rc1+dfsg-17.4.0~rc2+dfsg-17.4.0~rc3+dfsg-17.4.10+dfsg-17.4.2+dfsg-17.4.2+dfsg-27.4.3+dfsg-17.4.4+dfsg-17.4.5+dfsg-17.4.6+dfsg-17.4.6+dfsg-27.4.7+dfsg-1
7.4.12+dfsg-1
symfony/security-http
Packagist
 7.1.0 up to 7.4.12, plus listed versions
v7.1.0v7.1.1v7.1.10v7.1.11v7.1.2
Show 40 moreShow less
v7.1.3v7.1.4v7.1.5v7.1.6v7.1.7v7.1.8v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.1v7.2.3v7.2.4v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.10v7.3.2v7.3.3v7.3.4v7.3.5v7.3.8v7.3.9v7.4.0v7.4.0-BETA1v7.4.0-RC1v7.4.0-RC2v7.4.1v7.4.11v7.4.3v7.4.4v7.4.6v7.4.8v7.4.9
7.4.12
symfony/security-http
Packagist
 8.0.0 up to 8.0.12, plus listed versions
v8.0.0v8.0.1v8.0.11v8.0.3v8.0.4v8.0.6v8.0.8v8.0.9
8.0.12
symfony/symfony
Packagist
 7.1.0 up to 7.4.12, plus listed versions
v7.1.0v7.1.1v7.1.10v7.1.11v7.1.2
Show 45 moreShow less
v7.1.3v7.1.4v7.1.5v7.1.6v7.1.7v7.1.8v7.1.9v7.2.0v7.2.0-BETA1v7.2.0-BETA2v7.2.0-RC1v7.2.1v7.2.2v7.2.3v7.2.4v7.2.5v7.2.6v7.2.7v7.2.8v7.2.9v7.3.0v7.3.0-BETA1v7.3.0-BETA2v7.3.0-RC1v7.3.1v7.3.10v7.3.11v7.3.2v7.3.3v7.3.4v7.3.5v7.3.6v7.3.7v7.3.8v7.3.9v7.4.0v7.4.0-BETA1v7.4.0-BETA2v7.4.0-RC1v7.4.0-RC2v7.4.0-RC3v7.4.1v7.4.10v7.4.11v7.4.2
7.4.12
symfony/symfony
Packagist
 8.0.0 up to 8.0.12, plus listed versions
v8.0.0v8.0.1v8.0.10v8.0.11v8.0.2
Show 7 moreShow less
v8.0.3v8.0.4v8.0.5v8.0.6v8.0.7v8.0.8v8.0.9
8.0.12
symfony
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.7.1+dfsg-12.7.5+dfsg-12.7.9+dfsg-12.7.9+dfsg-1ubuntu22.7.10-0ubuntu2
 None known
Show 7 moreShow less
Affected packages
PackageAffectedFixed
symfony
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm13.4.6+dfsg-1ubuntu0.1+esm2
 None known
symfony
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1+esm14.3.8+dfsg-1ubuntu1+esm2
 None known
symfony
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.2.6+dfsg-1ubuntu75.4.4+dfsg-1ubuntu85.4.4+dfsg-1ubuntu8+esm1
 None known
symfony
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
5.4.23+dfsg-1ubuntu15.4.35+dfsg-3ubuntu16.4.5+dfsg-3ubuntu26.4.5+dfsg-3ubuntu36.4.5+dfsg-3ubuntu3+esm1
 None known
symfony
Ubuntu:25.10
 All versions, plus listed versions
6.4.18+dfsg-1ubuntu16.4.21+dfsg-26.4.21+dfsg-2ubuntu16.4.24+dfsg-1
 None known
symfony
Ubuntu:26.10
 All versions, plus listed versions
7.4.7+dfsg-1ubuntu17.4.9+dfsg-1ubuntu17.4.13+dfsg-2ubuntu17.4.14+dfsg-1ubuntu27.4.15+dfsg-2ubuntu27.4.16+dfsg-1ubuntu2
 None known
symfony
Ubuntu:26.04:LTS
 All versions, plus listed versions
6.4.24+dfsg-17.4.5+dfsg-1ubuntu17.4.6+dfsg-2ubuntu17.4.7+dfsg-1ubuntu1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-45074 is a high vulnerability (CVSS 7.6) in Sensiolabs Symfony, published May 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in symfony/security-http 7.4.12.

References

Show 9 moreShow less
This page doesn't list everything

Left out here: 9 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open