CVE-2021-21424
Prevent user enumeration using Guard or the new Authenticator-based Security
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Prevent user enumeration using Guard or the new Authenticator-based Security
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
- Record
CVE-2021-21424- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2021-0960
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
- Record
EUVD-2021-0960- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5pv8-ppvj-4h68
Prevent user enumeration using Guard or the new Authenticator-based Security
Description
The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.
Resolution
We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.
The patch for this issue is available here for branch 3.4.
Credits
I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
- Record
GHSA-5pv8-ppvj-4h68- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-203
- Updated
- 2026-11-02
NVD
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
- Record
CVE-2021-21424- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-203
- Updated
- 2026-11-02
OSV
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
- Record
CVE-2021-21424- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-21424
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
- Record
DEBIAN-CVE-2021-21424- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-5pv8-ppvj-4h68
Prevent user enumeration using Guard or the new Authenticator-based Security
Description
The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.
Resolution
We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.
The patch for this issue is available here for branch 3.4.
Credits
I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue.
- Record
GHSA-5pv8-ppvj-4h68- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-203
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-21424
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
- Record
UBUNTU-CVE-2021-21424- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-symfony-2021-21424 No score
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
- Record
BIT-symfony-2021-21424- Updated
- 2026-11-02
OSVUSN-5290-1 No score
symfony vulnerabilities
James Isaac and Mathias Brodala discovered that Symfony incorrectly handled switch users functionality. An attacker could possibly use this issue to enumerate users. (CVE-2021-21424)
It was discovered that Symfony incorrectly handled certain specially crafted CSV files. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 ESM. (CVE-2021-41270)
- Record
USN-5290-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
symfony/securityPackagist |
5.0.0 up to 5.2.8 | 5.2.8 |
symfony/security-guardPackagist |
2.8.0 up to 3.4.48 | 3.4.48 |
symfony/security-guardPackagist |
4.0.0 up to 4.4.23 | 4.4.23 |
symfony/security-guardPackagist |
5.0.0 up to 5.2.8 | 5.2.8 |
symfony/security-corePackagist |
2.8.0 up to 3.4.48 | 3.4.48 |
symfony/security-corePackagist |
4.0.0 up to 4.4.23 | 4.4.23 |
symfony/security-corePackagist |
5.0.0 up to 5.2.8 | 5.2.8 |
lexik/jwt-authentication-bundlePackagist |
2.0.0 up to 2.10.7 | 2.10.7 |
lexik/jwt-authentication-bundlePackagist |
2.11.0 up to 2.11.3 | 2.11.3 |
symfony/maker-bundlePackagist |
1.27.0 up to 1.29.2 | 1.29.2 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
symfony/maker-bundlePackagist |
1.30.0 up to 1.31.1 | 1.31.1 |
symfony/security-httpPackagist |
5.1.0 up to 5.2.8 | 5.2.8 |
symfony/securityPackagist |
2.8.0 up to 3.4.49 | 3.4.49 |
symfony/securityPackagist |
4.0.0 up to 4.4.24 | 4.4.24 |
symfony/symfonyPackagist |
2.8.0 up to 3.4.49 | 3.4.49 |
symfony/symfonyPackagist |
4.0.0 up to 4.4.24 | 4.4.24 |
symfony/symfonyPackagist |
5.0.0 up to 5.2.9 | 5.2.9 |
symfonyBitnami |
2.8.0 up to 3.4.48, 4.0.0 up to 4.4.23, 5.0.0 up to 5.2.8 | 3.4.484.4.235.2.8 |
symfonyDebian:12 |
before 4.4.19+dfsg-2 | 4.4.19+dfsg-2 |
symfonyDebian:13 |
before 4.4.19+dfsg-2 | 4.4.19+dfsg-2 |
symfonyDebian:14 |
before 4.4.19+dfsg-2 | 4.4.19+dfsg-2 |
symfonyDebian:10 From an advisory covering 3 CVEs |
before 3.4.22+dfsg-2+deb10u2, plus listed versions 3.4.22+dfsg-23.4.22+dfsg-2+deb10u1 |
3.4.22+dfsg-2+deb10u2 |
symfony/security-guardPackagist |
2.8.0 up to 3.4.48, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.52v2.8.6v2.8.7 |
3.4.48 |
symfony/security-guardPackagist |
4.0.0 up to 4.4.23, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 45 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1 |
4.4.23 |
symfony/security-guardPackagist |
5.0.0 up to 5.2.8, plus listed versions v5.0.0v5.0.1v5.0.10v5.0.11v5.0.2 Show 32 moreShow lessv5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.2v5.2.3v5.2.4 |
5.2.8 |
symfony/security-corePackagist |
2.8.0 up to 3.4.48, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.52v2.8.6v2.8.7 |
3.4.48 |
symfony/security-corePackagist |
4.0.0 up to 4.4.23, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 45 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1 |
4.4.23 |
symfony/security-corePackagist |
5.0.0 up to 5.2.8, plus listed versions v5.0.0v5.0.1v5.0.10v5.0.11v5.0.2 Show 35 moreShow lessv5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.2v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7 |
5.2.8 |
lexik/jwt-authentication-bundlePackagist |
2.0.0 up to 2.10.7, plus listed versions v2.0.0v2.0.1v2.0.2v2.0.3v2.1.0 Show 29 moreShow lessv2.1.1v2.10.0v2.10.1v2.10.2v2.10.3v2.10.4v2.10.5v2.10.6v2.2.0v2.3.0v2.4.0v2.4.1v2.4.2v2.4.3v2.4.4v2.5.0v2.5.1v2.5.2v2.5.3v2.5.4v2.6.0v2.6.1v2.6.2v2.6.3v2.6.4v2.6.5v2.7.0v2.8.0v2.9.0 |
2.10.7 |
lexik/jwt-authentication-bundlePackagist |
2.11.0 up to 2.11.3, plus listed versions v2.11.0v2.11.1v2.11.2 |
2.11.3 |
symfony/maker-bundlePackagist |
1.27.0 up to 1.29.2, plus listed versions v1.28.0v1.29.0v1.29.1 |
1.29.2 |
symfony/maker-bundlePackagist |
1.30.0 up to 1.31.1, plus listed versions v1.30.0v1.30.1v1.30.2v1.31.0 |
1.31.1 |
symfony/security-httpPackagist |
5.1.0 up to 5.2.8, plus listed versions v5.1.0v5.1.1v5.1.10v5.1.11v5.1.2 Show 20 moreShow lessv5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.2v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7 |
5.2.8 |
symfony/securityPackagist |
2.8.0 up to 3.4.49, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.52v2.8.6v2.8.7 |
3.4.49 |
symfony/securityPackagist |
4.0.0 up to 4.4.24, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 45 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0v4.3.0-BETA1 |
4.4.24 |
symfony/symfonyPackagist |
2.8.0 up to 3.4.49, plus listed versions v2.8.0v2.8.1v2.8.10v2.8.11v2.8.12 Show 45 moreShow lessv2.8.13v2.8.14v2.8.15v2.8.16v2.8.17v2.8.18v2.8.19v2.8.2v2.8.20v2.8.21v2.8.22v2.8.23v2.8.24v2.8.25v2.8.26v2.8.27v2.8.28v2.8.29v2.8.3v2.8.30v2.8.31v2.8.32v2.8.33v2.8.34v2.8.35v2.8.36v2.8.37v2.8.38v2.8.39v2.8.4v2.8.40v2.8.41v2.8.42v2.8.43v2.8.44v2.8.45v2.8.46v2.8.47v2.8.48v2.8.49v2.8.5v2.8.50v2.8.51v2.8.52v2.8.6 |
3.4.49 |
symfony/symfonyPackagist |
4.0.0 up to 4.4.24, plus listed versions v4.0.0v4.0.1v4.0.10v4.0.11v4.0.12 Show 45 moreShow lessv4.0.13v4.0.14v4.0.15v4.0.2v4.0.3v4.0.4v4.0.5v4.0.6v4.0.7v4.0.8v4.0.9v4.1.0v4.1.0-BETA1v4.1.0-BETA2v4.1.0-BETA3v4.1.1v4.1.10v4.1.11v4.1.12v4.1.13v4.1.2v4.1.3v4.1.4v4.1.5v4.1.6v4.1.7v4.1.8v4.1.9v4.2.0v4.2.0-BETA1v4.2.0-BETA2v4.2.0-RC1v4.2.1v4.2.10v4.2.11v4.2.12v4.2.2v4.2.3v4.2.4v4.2.5v4.2.6v4.2.7v4.2.8v4.2.9v4.3.0 |
4.4.24 |
symfony/symfonyPackagist |
5.0.0 up to 5.2.9, plus listed versions v5.0.0v5.0.1v5.0.10v5.0.11v5.0.2 Show 36 moreShow lessv5.0.3v5.0.4v5.0.5v5.0.6v5.0.7v5.0.8v5.0.9v5.1.0v5.1.0-BETA1v5.1.0-RC1v5.1.0-RC2v5.1.1v5.1.10v5.1.11v5.1.2v5.1.3v5.1.4v5.1.5v5.1.6v5.1.7v5.1.8v5.1.9v5.2.0v5.2.0-BETA1v5.2.0-BETA2v5.2.0-BETA3v5.2.0-RC1v5.2.0-RC2v5.2.1v5.2.2v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8 |
5.2.9 |
symfonyUbuntu:Pro:18.04:LTS |
before 3.4.6+dfsg-1ubuntu0.1+esm2, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm1 |
3.4.6+dfsg-1ubuntu0.1+esm2 |
symfonyUbuntu:Pro:20.04:LTS |
before 4.3.8+dfsg-1ubuntu1+esm1, plus listed versions 4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1 |
4.3.8+dfsg-1ubuntu1+esm1 |
symfonyUbuntu:Pro:18.04:LTS From an advisory covering 2 CVEs |
before 3.4.6+dfsg-1ubuntu0.1+esm2, plus listed versions 2.8.7+dfsg-1.3ubuntu13.4.3+dfsg-1ubuntu43.4.6+dfsg-13.4.6+dfsg-1ubuntu0.13.4.6+dfsg-1ubuntu0.1+esm1 |
3.4.6+dfsg-1ubuntu0.1+esm2 |
symfonyUbuntu:Pro:20.04:LTS From an advisory covering 2 CVEs |
before 4.3.8+dfsg-1ubuntu1+esm1, plus listed versions 4.3.4+dfsg-1ubuntu14.3.8+dfsg-1ubuntu1 |
4.3.8+dfsg-1ubuntu1+esm1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | moften/CVE-2021-21424 | 2025-04-14 |
| PoC in GitHub | moften/Symfony-CVE-Scanner-PoC- | 2025-05-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21424 is a medium vulnerability (CVSS 5.3) in Sensiolabs Symfony, published May 13, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.64%, the 76th percentile. Fixed in symfony/security 5.2.8.
References
github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KENRNLB3FYXYGDWRBH2PDBOZZKOD7VY4
Show 22 moreShow less
lists.debian.org/debian-lts-announce/2023/07/msg00014.html
nvd.nist.gov/vuln/detail/CVE-2021-21424
symfony.com/cve-2021-21424
security-tracker.debian.org/tracker/CVE-2021-21424
ubuntu.com/security/CVE-2021-21424
cve.org/CVERecord?id=CVE-2021-21424
Left out here: 636 versions. The JSON record has them.