CVE-2026-118513 Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)

Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to...

CVE-2026-118513 Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)

Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to...

CVE-2026-118513

Symfony versions prior to 5.4.56 , 6.x prior to 6.4.50 , 7.x prior to 7.4.23 , and 8.x prior to 8.1.11 are vulnerable to an authentication bypass via spoofing in the X509Authenticator and X509AuthenticationListener components. This vulnerability stems from an incomplete fix for CVE-2026-45063 , w...