CVE-2026-45069

NameCVE-2026-45069
DescriptionSymfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-6312-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
symfony (PTS)bullseye4.4.19+dfsg-2+deb11u6vulnerable
bullseye (security)4.4.19+dfsg-2+deb11u7vulnerable
bookworm, bookworm (security)5.4.53+dfsg-0+deb12u1fixed
trixie (security), trixie6.4.41+dfsg-0+deb13u1fixed
forky, sid7.4.14+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
symfonysourcebookworm(not affected)
symfonysourcetrixie6.4.41+dfsg-0+deb13u1DSA-6312-1
symfonysource(unstable)7.4.12+dfsg-1

Notes

[bookworm] - symfony <not-affected> (Vulnerable code not present, introduced in 6.3)
https://symfony.com/blog/cve-2026-45069-oidctokenhandler-accepts-jwts-missing-aud-iss-exp-claims

Search for package or bug name: Reporting problems