CVE-2026-118513 Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)

Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to...

CVE-2026-118513

Symfony versions prior to 5.4.56 , 6.x prior to 6.4.50 , 7.x prior to 7.4.23 , and 8.x prior to 8.1.11 are vulnerable to an authentication bypass via spoofing in the X509Authenticator and X509AuthenticationListener components. This vulnerability stems from an incomplete fix for CVE-2026-45063 , w...

CVE-2026-118513 Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)

Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to...

CVE-2026-118513: X509Authenticator and X509AuthenticationListener Read Escaped RFC 2253 Commas and Bare Slashes Inside a DN Value as RDN Boundaries: Incomplete Fix for CVE-2026-45063

More info at https://symfony.com/cve-2026-118513...