CVE-2026-123746

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.56 Symfony versions 6.x prior to 6.4.50 Symfony versions 7.x prior to 7.4.23 Symfony versions 8.x prior to 8.1.11

Description The Symfony Security HTTP component contains an issue where the authenticateUser() function in AuthenticatorManager fails to execute the checkPostAuth() method of the firewall user checker during programmatic authentication. This occurs because authenticateUser()—which is utilized by UserAuthenticatorInterface::authenticateUser() and Security::login()—does not dispatch the security.authentication.success event required for checkPostAuth() to run. Consequently, users with accounts that should be rejected by a custom user checker (such as expired accounts) can still obtain an authenticated session if they are authenticated programmatically, such as through email verification links or password resets, even though they would be blocked by standard form logins.

Recommendations Update to version 5.4.56 or later. Update to version 6.4.50 or later. Update to version 7.4.23 or later. Update to version 8.1.11 or later.