CVE-2026-123746 Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

The Symfony Security HTTP component AuthenticatorManager::authenticateUser does not run the firewall user checker’s checkPostAuth method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony...