← CVE Radar
CVE-2026-45074Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.
7.6 HIGHEPSS 0.48%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.6 | HIGH | 4.0GitHub_M (CNA) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| 8.1 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Details
- CVE ID
- CVE-2026-45074
- Status
- Analyzed
- Assigner (CNA)
- GitHub_M
- Published
- Jul 14, 2026
- Last modified
- 2026-07-15 15:35 UTC
- Weaknesses
- CWE-290 · Authentication Bypass by Spoofing
Affected Products
As published by the CNA in the CVE record.
symfonysymfony2 version ranges
- >= 7.1.0-BETA1, < 7.4.12
- >= 8.0.0-BETA1, < 8.0.12
symfonysecurity-http2 version ranges
- >= 7.1.0-BETA1, < 7.4.12
- >= 8.0.0-BETA1, < 8.0.12
References
- github.com https://github.com/symfony/symfony/commit/5ba145dba702404801bdf9e7e8d6df170060d541
- github.com https://github.com/symfony/symfony/releases/tag/v7.4.12
- github.com https://github.com/symfony/symfony/releases/tag/v8.0.12
- github.com https://github.com/symfony/symfony/security/advisories/GHSA-j8gj-9rm5-4xhx