EUVD-2026-117008

The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope such as authbearer or authbasic into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together...

CVE-2026-121971

The ScopingHttpClient component in Symfony HttpClient is vulnerable to a credential disclosure flaw. The application incorrectly merges default scope options (such as auth_bearer or auth_basic ) into a request before resolving a relative URL against a base_uri . This allows a network-path referen...