Symfony's OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
The advisory, in context
Description
OidcTokenHandler is Symfony's built-in access-token handler for OpenID Connect: it validates a bearer JWT and returns the authenticated user identity. It delegates claim validation to the web-token/jwt-checker library's ClaimCheckerManager.
OidcTokenHandler::verifyClaims() registers audience (aud), issuer (iss), and expiry (exp) checkers, but never passes the $mandatoryClaims argument to ClaimCheckerManager::check(). That method only validates claims that are present in the token: a checker for an absent claim is silently skipped. A validly-signed JWT that simply omits aud, iss, and exp therefore passes verification.
Resolution
The OidcTokenHandler now calls the ClaimCheckerManager with the list of mandatory claims so that tokens missing aud, iss, or exp are rejected.
The patch for this issue is available here for branch 6.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 6.3.0 before 6.4.40
Fixed in 6.4.40
35 explicitly affected versions
v6.3.0, v6.3.1, v6.3.12, v6.3.2, v6.3.4, v6.3.5, v6.3.6, v6.3.8, v6.4.0, v6.4.0-BETA1, v6.4.0-BETA3, v6.4.0-RC1, v6.4.0-RC2, v6.4.11, v6.4.12, v6.4.13, v6.4.14, v6.4.15, v6.4.18, v6.4.19, v6.4.21, v6.4.22, v6.4.23, v6.4.24, v6.4.25, v6.4.26, v6.4.3, v6.4.30, v6.4.31, v6.4.34, v6.4.39, v6.4.4, v6.4.7, v6.4.8, v6.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.3.0"
},
{
"fixed": "6.4.40"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.3.0",
"v6.3.1",
"v6.3.12",
"v6.3.2",
"v6.3.4",
"v6.3.5",
"v6.3.6",
"v6.3.8",
"v6.4.0",
"v6.4.0-BETA1",
"v6.4.0-BETA3",
"v6.4.0-RC1",
"v6.4.0-RC2",
"v6.4.11",
"v6.4.12",
"v6.4.13",
"v6.4.14",
"v6.4.15",
"v6.4.18",
"v6.4.19",
"v6.4.21",
"v6.4.22",
"v6.4.23",
"v6.4.24",
"v6.4.25",
"v6.4.26",
"v6.4.3",
"v6.4.30",
"v6.4.31",
"v6.4.34",
"v6.4.39",
"v6.4.4",
"v6.4.7",
"v6.4.8",
"v6.4.9"
]
}From 7.4.0 before 7.4.12
Fixed in 7.4.12
8 explicitly affected versions
v7.4.0, v7.4.1, v7.4.11, v7.4.3, v7.4.4, v7.4.6, v7.4.8, v7.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.4.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v7.4.0",
"v7.4.1",
"v7.4.11",
"v7.4.3",
"v7.4.4",
"v7.4.6",
"v7.4.8",
"v7.4.9"
]
}From 8.0.0 before 8.0.12
Fixed in 8.0.12
8 explicitly affected versions
v8.0.0, v8.0.1, v8.0.11, v8.0.3, v8.0.4, v8.0.6, v8.0.8, v8.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v8.0.0",
"v8.0.1",
"v8.0.11",
"v8.0.3",
"v8.0.4",
"v8.0.6",
"v8.0.8",
"v8.0.9"
]
}From 6.3.0 before 6.4.40
Fixed in 6.4.40
58 explicitly affected versions
v6.3.0, v6.3.1, v6.3.10, v6.3.11, v6.3.12, v6.3.2, v6.3.3, v6.3.4, v6.3.5, v6.3.6, v6.3.7, v6.3.8, v6.3.9, v6.4.0, v6.4.0-BETA1, v6.4.0-BETA2, v6.4.0-BETA3, v6.4.0-RC1, v6.4.0-RC2, v6.4.1, v6.4.10, v6.4.11, v6.4.12, v6.4.13, v6.4.14, v6.4.15, v6.4.16, v6.4.17, v6.4.18, v6.4.19, v6.4.2, v6.4.20, v6.4.21, v6.4.22, v6.4.23, v6.4.24, v6.4.25, v6.4.26, v6.4.27, v6.4.28, v6.4.29, v6.4.3, v6.4.30, v6.4.31, v6.4.32, v6.4.33, v6.4.34, v6.4.35, v6.4.36, v6.4.37, v6.4.38, v6.4.39, v6.4.4, v6.4.5, v6.4.6, v6.4.7, v6.4.8, v6.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "6.3.0"
},
{
"fixed": "6.4.40"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v6.3.0",
"v6.3.1",
"v6.3.10",
"v6.3.11",
"v6.3.12",
"v6.3.2",
"v6.3.3",
"v6.3.4",
"v6.3.5",
"v6.3.6",
"v6.3.7",
"v6.3.8",
"v6.3.9",
"v6.4.0",
"v6.4.0-BETA1",
"v6.4.0-BETA2",
"v6.4.0-BETA3",
"v6.4.0-RC1",
"v6.4.0-RC2",
"v6.4.1",
"v6.4.10",
"v6.4.11",
"v6.4.12",
"v6.4.13",
"v6.4.14",
"v6.4.15",
"v6.4.16",
"v6.4.17",
"v6.4.18",
"v6.4.19",
"v6.4.2",
"v6.4.20",
"v6.4.21",
"v6.4.22",
"v6.4.23",
"v6.4.24",
"v6.4.25",
"v6.4.26",
"v6.4.27",
"v6.4.28",
"v6.4.29",
"v6.4.3",
"v6.4.30",
"v6.4.31",
"v6.4.32",
"v6.4.33",
"v6.4.34",
"v6.4.35",
"v6.4.36",
"v6.4.37",
"v6.4.38",
"v6.4.39",
"v6.4.4",
"v6.4.5",
"v6.4.6",
"v6.4.7",
"v6.4.8",
"v6.4.9"
]
}From 7.4.0 before 7.4.12
Fixed in 7.4.12
12 explicitly affected versions
v7.4.0, v7.4.1, v7.4.10, v7.4.11, v7.4.2, v7.4.3, v7.4.4, v7.4.5, v7.4.6, v7.4.7, v7.4.8, v7.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.4.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v7.4.0",
"v7.4.1",
"v7.4.10",
"v7.4.11",
"v7.4.2",
"v7.4.3",
"v7.4.4",
"v7.4.5",
"v7.4.6",
"v7.4.7",
"v7.4.8",
"v7.4.9"
]
}From 8.0.0 before 8.0.12
Fixed in 8.0.12
12 explicitly affected versions
v8.0.0, v8.0.1, v8.0.10, v8.0.11, v8.0.2, v8.0.3, v8.0.4, v8.0.5, v8.0.6, v8.0.7, v8.0.8, v8.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v8.0.0",
"v8.0.1",
"v8.0.10",
"v8.0.11",
"v8.0.2",
"v8.0.3",
"v8.0.4",
"v8.0.5",
"v8.0.6",
"v8.0.7",
"v8.0.8",
"v8.0.9"
]
}References
- https://github.com/symfony/symfony/security/advisories/GHSA-29fc-p6c4-24cg
- https://github.com/symfony/symfony/commit/6b717aaac21b7e96798448d14c4355ea87690b3d
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45069.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45069.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45069