Sensiolabs
CVE-2026-118513: Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4
CVE-2026-118513 Nov 4, 2026 Source: Vendor
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary user of the application, including a privileged one, following an incomplete fix for CVE-2026-45063.
X509Authenticator extracts the user identifier from the Subject DN (Distinguis
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-118513
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
3 lines
Showing 1–3 of 3
CVE-2026-118513
BR2026-0000-042240
unclaimed
Credited as Oryam Halachmi
CVE-2026-118513
BR2026-0000-042241
unclaimed
Credited as Dahmani Toumi
CVE-2026-118513
BR2026-0000-042242
unclaimed
Credited as Stapat