CVE-2026-123746

The Symfony Security HTTP component contains a vulnerability where AuthenticatorManager::authenticateUser() fails to execute the checkPostAuth() method of user checkers during programmatic authentication. This occurs because the method does not dispatch the security.authentication.success event, ...

CVE-2026-123746: sensiolabs symfony: The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s…

The Symfony Security HTTP component AuthenticatorManager::authenticateUser does not run the firewall user checker’s checkPostAuth method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony...