Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-16 | 1 | Patch1 |
| 2026-08-10 | 2 | Disclosure1Patch1 |
Symfonyに認証バイパスの脆弱性。クライアント証明書認証を使っていなければ影響しませんが、使っているなら急ぎです。修正版は5.4.52 / 6.4.40 / 7.4.12 / 8.0.12。composerの依存更新なのでOSのセキュリティ更新では直りません。 https://cve.autoarticles.net/cve/CVE-2026-45063
Post summary
The post announces a Symfony authentication bypass vulnerability and provides specific patch versions, emphasizing the need for a composer dependency update to mitigate the risk.
正規表現の先頭を固定し忘れると、認証バイパスになります。SymfonyのX509Authenticatorが識別名のどこにあるemailAddress=にも一致していた話。CNに値を埋め込むだけで別人になりすませます。アンカーを省かない理由を、実際のCVEから追いました。 https://blog.hashito.biz/2026/08/10/symfony-x509-authenticator-unanchored-regex-cve-2026-45063/
Post summary
The post discusses a new CVE affecting Symfony’s X509Authenticator, detailing how a missing regex anchor enables authentication bypass and user impersonation.
🚨 CRITICAL: CVE-2026-45063 | CVSS 9.1 Symfony PHP framework authentication bypass via X509Authenticator regex flaw. Attackers with trusted certs can impersonate victims. Patch NOW: 5.4.52, 6.4.40, 7.4.12, 8.0.12 #CVE #Vulnerability #PatchNow https://t.co/MsCSfNQj8h
Post summary
The tweet announces a critical authentication bypass in Symfony, details the vulnerability mechanism, and urges immediate patching with specific version fixes.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | sensiolabs | symfony | - | - | - |