GHSA-8wx3-8m4x-g5h4
FOSUserBundle User Identity Validation Vulnerability
GHSA-8wx3-8m4x-g5h4 is a vulnerability with no CVSS score yet in friendsofsymfony/user-bundle, published May 15, 2024. No source lists public exploit code. Fixed in friendsofsymfony/user-bundle 1.2.1.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.2.1friendsofsymfony/user-bundle +1 more
Description
Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their username. The fix in version 1.2.1 addresses this issue by loading the user using the primary key during refreshing.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
friendsofsymfony/user-bundlePackagist | 1.0.0 up to 1.2.1 | 1.2.1 |
friendsofsymfony/user-bundlePackagist | 1.0.0 up to 1.2.1, plus listed versions 1.1.01.2.0 | 1.2.1 |
What each source reports
GitHub AdvisoriesNo score
FOSUserBundle User Identity Validation Vulnerability
Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their username. The fix in version 1.2.1 addresses this issue by loading the user using the primary key during refreshing.
- Record
GHSA-8wx3-8m4x-g5h4- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVNo score
FOSUserBundle User Identity Validation Vulnerability
Versions of FOSUserBundle prior to 1.2.1 have been found to be vulnerable to a security issue related to user identity validation. Specifically, user refreshing was performed using the primary key instead of the username, leading to a potential security risk if a user is allowed to change their username. The fix in version 1.2.1 addresses this issue by loading the user using the primary key during refreshing.
- Record
GHSA-8wx3-8m4x-g5h4- Weakness
- CWE-285
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/FriendsOfSymfony/FOSUserBundle/commit/5a36e2958068d1e6501dc8cf39bbae3ebb859d9f