Insufficient verification of data authenticity in Symfony - CVE-2026-45069
Published: May 21, 2026
Vulnerability identifier: #VU132074
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45069
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass JWT claim validation.
The vulnerability exists due to insufficient verification of data authenticity in OidcTokenHandler::verifyClaims() when processing a validly signed bearer JWT missing required claims. A remote attacker can supply a validly signed JWT that omits the aud, iss, and exp claims to bypass JWT claim validation.
Affected software
Symfony
Debian Linux
symfony (Debian package)
Debian Linux
symfony (Debian package)
How to mitigate CVE-2026-45069
Install security update from vendor's website.
Symfony - addressed in versions 6.4.40, 7.4.12, 8.0.12
symfony (Debian package) - update to 6.4.41+dfsg-0+deb13u1
symfony (Debian package) - update to 6.4.41+dfsg-0+deb13u1