Authentication Bypass by Spoofing in Symfony - CVE-2026-45074

Detailed vulnerability description

The vulnerability allows a remote user to bypass authentication.

The vulnerability exists due to authentication bypass by spoofing in Cas2Handler when deriving the CAS service parameter from an attacker-controlled Host header during ticket validation. A remote user can replay a victim's CAS ticket with a spoofed Host header to bypass authentication.

Exploitation requires control of another application registered with the same CAS server.

How to mitigate CVE-2026-45074

Sources

• https://github.com/symfony/symfony/security/advisories/GHSA-j8gj-9rm5-4xhx
• https://github.com/symfony/symfony/commit/5ba145dba702404801bdf9e7e8d6df170060d541