Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

🗓️ 27 May 2026 21:03:36Reported by GitHub Advisory DatabaseType

Symfony's OidcTokenHandler now enforces mandatory OIDC claims by passing them to the checker and rejects tokens missing aud iss exp.

Reporter	Title	Published	Views	Family All 20
ATTACKERKB	CVE-2026-45069	14 Jul 202618:46	–	attackerkb
Circl	CVE-2026-45069	20 May 202610:58	–	circl
CVE	CVE-2026-45069	14 Jul 202618:46	–	cve
Cvelist	CVE-2026-45069 Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims	14 Jul 202618:46	–	cvelist
Debian	[SECURITY] [DSA 6312-1] symfony security update	31 May 202612:26	–	debian
Debian CVE	CVE-2026-45069	14 Jul 202618:46	–	debiancve
Tenable Nessus	Debian dsa-6312 : php-symfony - security update	1 Jun 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-45069	21 May 202600:00	–	nessus
EUVD	EUVD-2026-44357	14 Jul 202618:46	–	euvd
Friends Of PHP	CVE-2026-45069: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims	1 Jan 197000:00	–	friendsofphp

Vulners

Node

symfony symfonyRange8.0.0–8.0.12composer

symfony symfonyRange7.4.0–7.4.12composer

symfony symfonyRange6.3.0–6.4.40composer

symfony security-httpRange8.0.0–8.0.12composer

symfony security-httpRange7.4.0–7.4.12composer

symfony security-httpRange6.3.0–6.4.40composer

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-29fc-p6c4-24cg
github	www.github.com/symfony/symfony/commit/6b717aaac21b7e96798448d14c4355ea87690b3d
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45069.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45069.yaml
symfony	www.symfony.com/cve-2026-45069
github	www.github.com/advisories/GHSA-29fc-p6c4-24cg

27 May 2026 21:03Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.19.1

CVSS 48.8

EPSS0.00237

SSVC