CVE-2026-45069 is a critical (CVSS 9.1) flaw in Symfony's OidcTokenHandler. It never marked audience, issuer and expiry as mandatory, so a validly signed JWT that left them out could pass. Fixed in Symfony 6.4.40, 7.4.12 and 8.0.12.
What's affected
Per the GitHub advisory, symfony/security-http and symfony/symfony from 6.3 up to the fixed releases are affected. The fixed releases are 6.4.40, 7.4.12 and 8.0.12. The 5.4 line is not named in this CVE. No workaround is documented.
How to check if you're exposed
composer show symfony/security-http
grep -rn "oidc" config/packages/security.yaml
The first command prints the installed version. The second finds firewalls using the OIDC token handler. Only those are in scope.
What to do now
- Upgrade to a fixed release on your branch and redeploy.
- Confirm the version with composer show.
- Review which identity providers your application trusts for OIDC.
- Check logs for accepted tokens that lack expected claims, if your logging records claims.
Why it matters
The weaknesses are CWE-345 and CWE-1287: insufficient verification of data authenticity and improper validation of a specified type of input. The claim checker manager only validates claims that are present. Without a mandatory list, a missing claim is simply never checked. The KEV flag is false.
Quick check
Is a valid signature enough to trust a JWT?
No. The signature proves who issued the token. Audience, issuer and expiry tell you whether it was meant for you and whether it is still valid.
Sources
Last reviewed: 19 October 2026.
