CVE-2026-121971

The ScopingHttpClient component in Symfony HttpClient is vulnerable to a credential disclosure flaw. The application incorrectly merges default scope options (such as auth_bearer or auth_basic ) into a request before resolving a relative URL against a base_uri . This allows a network-path referen...