CVE-2026-121971

A flaw was found in Symfony HttpClient. The scoped HTTP client attaches default authentication credentials to requests before verifying that the resolved destination matches the intended trusted domain. A remote attacker who can control or influence the target URL can supply a specially crafted...