CVE-2016-2403
Symfony Authentication Bypass
CVE-2016-2403 is a critical vulnerability (CVSS 9.8) in Sensiolabs Symfony, published February 7, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.29%, the 91st percentile. Fixed in symfony/security-core 2.8.6.
- Severity
- 9.8 CriticalCVSS 3.0, NVD
- Exploit chance
- 4.29%EPSS, 91st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.8.6symfony/security-core +15 more
Description
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/security-corePackagist | 2.8.0 up to 2.8.6 | 2.8.6 |
symfony/security-corePackagist | 3.0.0 up to 3.0.6 | 3.0.6 |
symfony/securityPackagist | 2.8.0 up to 2.8.6 | 2.8.6 |
symfony/securityPackagist | 3.0.0 up to 3.0.6 | 3.0.6 |
symfony/symfonyPackagist | 2.8.0 up to 2.8.6 | 2.8.6 |
symfony/symfonyPackagist | 3.0.0 up to 3.0.6 | 3.0.6 |
symfonyDebian:12 | before 2.8.6+dfsg-1 | 2.8.6+dfsg-1 |
symfonyDebian:13 | before 2.8.6+dfsg-1 | 2.8.6+dfsg-1 |
symfonyDebian:14 | before 2.8.6+dfsg-1 | 2.8.6+dfsg-1 |
symfonyDebian:9 From an advisory covering 8 CVEs | before 2.8.7+dfsg-1.3+deb9u1, plus listed versions 2.8.7+dfsg-1.3 | 2.8.7+dfsg-1.3+deb9u1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/security-corePackagist | 2.8.0 up to 2.8.6, plus listed versions v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5 | 2.8.6 |
symfony/security-corePackagist | 3.0.0 up to 3.0.6, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5 | 3.0.6 |
symfony/securityPackagist | 2.8.0 up to 2.8.6, plus listed versions v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5 | 2.8.6 |
symfony/securityPackagist | 3.0.0 up to 3.0.6, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5 | 3.0.6 |
symfony/symfonyPackagist | 2.8.0 up to 2.8.6, plus listed versions v2.8.0v2.8.1v2.8.2v2.8.3v2.8.4v2.8.5 | 2.8.6 |
symfony/symfonyPackagist | 3.0.0 up to 3.0.6, plus listed versions v3.0.0v3.0.1v3.0.2v3.0.3v3.0.4v3.0.5 | 3.0.6 |
What each source reports
NVD Score used
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- Record
CVE-2016-2403- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE ListNo score
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- Record
CVE-2016-2403- Updated
- 2026-11-02
EUVDEUVD-2022-5646No score
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- Record
EUVD-2022-5646- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wvj5-r78r-hhfq
Symfony Authentication Bypass
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- Record
GHSA-wvj5-r78r-hhfq- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- Record
CVE-2016-2403- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-2403
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- Record
DEBIAN-CVE-2016-2403- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-wvj5-r78r-hhfq
Symfony Authentication Bypass
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- Record
GHSA-wvj5-r78r-hhfq- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-2403
Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
- Record
UBUNTU-CVE-2016-2403- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password
debian.org/security/2018/dsa-4262
securityfocus.com/bid/96137
nvd.nist.gov/vuln/detail/CVE-2016-2403
web.archive.org/web/20210123224944/http://www.securityfocus.com/bid/96137
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-2403.yaml
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2016-2403
ubuntu.com/security/CVE-2016-2403
cve.org/CVERecord?id=CVE-2016-2403