CVE-2026-123746

The Symfony Security HTTP component AuthenticatorManager::authenticateUser does not run the firewall user checker’s checkPostAuth method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony...