CVE-2026-118513

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions prior to 6.4.50 Symfony versions prior to 7.4.23 Symfony versions prior to 8.1.11

Description An authentication bypass exists in X509Authenticator and X509AuthenticationListener where an attacker possessing a certificate from a trusted CA can authenticate as an arbitrary user, including privileged accounts, by influencing the Common Name (CN). The issue stems from an incomplete fix where the regular expression used to extract user identifiers from the Subject DN (Distinguished Name) passed in $ SERVER['SSL CLIENT S DN'] was not escape-aware. Consequently, the system fails to distinguish between actual RDN (Relative Distinguished Name) separators and separator characters contained within a value. Under RFC 2253, escaped commas are incorrectly read as separators, and bare slashes are treated as separators. In the legacy X509 NAME oneline() format, bare commas are treated as separators. This allows a poisoned CN to smuggle a different user address for authentication.

Recommendations Update Symfony to version 5.4.56 or later. Update Symfony to version 6.4.50 or later. Update Symfony to version 7.4.23 or later. Update Symfony to version 8.1.11 or later.