CVE-2026-45063 is a critical (CVSS 9.1) authentication flaw in Symfony's X509Authenticator. An unanchored regular expression can pick the wrong email out of a certificate subject, so a holder of a trusted certificate can sign in as someone else. Fixed in Symfony 5.4.52, 6.4.40, 7.4.12 and 8.0.12.
What's affected
The GitHub advisory covers symfony/security-http and symfony/symfony: everything below 5.4.52, the 6.x line below 6.4.40, the 7.x line below 7.4.12 and the 8.0 line below 8.0.12.
Fixed releases are 5.4.52, 6.4.40, 7.4.12 and 8.0.12. The advisory describes no workaround, so upgrading is the remedy. It only matters if you use X.509 client certificate authentication.
How to check if you're exposed
composer show symfony/security-http
composer show symfony/symfony
grep -rn "x509" config/packages/security.yaml
The first two commands print the installed version. The grep finds firewalls that use the x509 authenticator. If you have none, the code path is unused, but upgrade anyway.
What to do now
- Run composer update symfony/security-http, or the full framework package, to a fixed release for your branch.
- Redeploy and confirm the version with composer show.
- If you use client certificates, review which certificate authorities you trust and who can get a certificate with free text fields.
- Check access logs for logins by privileged users that you cannot tie to a known certificate.
Why it matters
The class is CWE-290, authentication bypass by spoofing. The authenticator reads the Subject DN from the server environment and matches emailAddress= anywhere in it, including inside another field such as the common name. Someone with a certificate from a trusted authority and a free text name can embed another person's address and be treated as that person. The fix anchors the match to the boundary of a name component.
Try it yourself
See how a dependency finding becomes a decision when you check whether it can be exploited in your setup.
Click through it at your own pace, or open it full screen.
Quick check
Do I need to act if I only use form login?
The flaw sits in the X509Authenticator. If you do not use it, you are not exposed to this path, but upgrading is still sensible as part of normal patching.
Sources
Last reviewed: 19 October 2026.
