CVE-2026-45063
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in Symfony X509Authenticator allows an attacker with a trusted certificate to impersonate a victim by placing emailAddress= in another RDN value, such as CN, due to an unanchored regex.
Risk Assessment
The organization is at risk of unauthorized access to systems authenticating via X.509 certificates, potentially leading to data confidentiality and integrity breaches.
Recommendation
Immediately upgrade Symfony to version 5.4.52, 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Original NVD description (English source)
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, X509Authenticator extracts the user identifier from $_SERVER['SSL_CLIENT_S_DN'] with an unanchored regex that matches emailAddress= anywhere in the distinguished name, allowing an attacker with a trusted certificate containing emailAddress=victim inside another RDN value such as CN to authenticate as the victim. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.