CVE-2026-121971

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions prior to 6.4.50 Symfony versions prior to 7.4.23 Symfony versions prior to 8.1.11

Description The ScopingHttpClient component in Symfony HttpClient merges default scope options, such as auth bearer or auth basic, into a request before resolving a relative URL against the base uri. This allows a network-path reference to be sent to a different origin while retaining the default scope credentials, potentially disclosing them to an attacker-controlled server. This occurs when the resolved URL falls outside the origin of the base URI, including cases with different ports or user-info on the same host. The issue is reachable if an attacker controls the beginning of a URL passed to a client configured with a base uri and credentials, specifically those created via HttpClient::createForBaseUri() or configured under framework.http client.scoped clients.

Recommendations Update Symfony to version 5.4.56 or later. Update Symfony to version 6.4.50 or later. Update Symfony to version 7.4.23 or later. Update Symfony to version 8.1.11 or later.