CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
Attackers can spoof identities and authenticate as victims by exploiting an unanchored regex in the X509Authenticator component of the Symfony framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45063?
CVE-2026-45063 is a critical authentication bypass vulnerability in Sensiolabs Symfony, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Weakness: CWE-290
Which versions are affected by CVE-2026-45063?
16 open source packages ship an affected version, including symfony/security-http and symfony/symfony. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/security-http Packagist | All versions | 5.4.52 |
symfony/security-http Packagist | All versions | 5.4.52 |
symfony/security-http Packagist | From 6.0.0-BETA1 | 6.4.40 |
symfony/security-http Packagist | From 6.0.0-BETA1 | 6.4.40 |
symfony/security-http Packagist | From 7.0.0-BETA1 | 7.4.12 |
symfony/security-http Packagist | From 7.0.0-BETA1 | 7.4.12 |
10 more packages
symfony/security-http Packagist | From 8.0.0-BETA1 | 8.0.12 |
symfony/security-http Packagist | From 8.0.0-BETA1 | 8.0.12 |
symfony/symfony Packagist | All versions | 5.4.52 |
symfony/symfony Packagist | All versions | 5.4.52 |
symfony/symfony Packagist | From 6.0.0-BETA1 | 6.4.40 |
symfony/symfony Packagist | From 6.0.0-BETA1 | 6.4.40 |
symfony/symfony Packagist | From 7.0.0-BETA1 | 7.4.12 |
symfony/symfony Packagist | From 7.0.0-BETA1 | 7.4.12 |
symfony/symfony Packagist | From 8.0.0-BETA1 | 8.0.12 |
symfony/symfony Packagist | From 8.0.0-BETA1 | 8.0.12 |
Products include Sensiolabs Symfony.
How do I fix CVE-2026-45063?
Upgrade symfony/security-http to a fixed version for your release line: 5.4.52, 6.4.40, 7.4.12 or 8.0.12.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-45063 being exploited?
There is no known exploitation of CVE-2026-45063 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
Sources
Also known as DEBIAN-CVE-2026-45063, GHSA-ph86-p8f6-f9r2, UBUNTU-CVE-2026-45063.