Symfony's Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
The advisory, in context
Cas2Handler builds this service parameter from Request::getSchemeAndHttpHost(), which reflects the attacker-controlled HTTP Host header whenever Symfony's framework.trusted_hosts setting is not configured (the default). An attacker who controls any other application registered with the same CAS server can replay a victim's ticket against the Symfony application, with a spoofed Host header, and be authenticated as that victim.
Resolution
A new required service_url configuration option is introduced on Cas2Handler. The CAS service parameter sent to the validation endpoint is now built from this configured URL instead of being derived from the request's Host header, preventing cross-service ticket replay via Host header spoofing.
The patch for this issue is available here for branch 7.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Nicolas Grekas for providing the fix.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 7.1.0 before 7.4.12
Fixed in 7.4.12
45 explicitly affected versions
v7.1.0, v7.1.1, v7.1.10, v7.1.11, v7.1.2, v7.1.3, v7.1.4, v7.1.5, v7.1.6, v7.1.7, v7.1.8, v7.2.0, v7.2.0-BETA1, v7.2.0-BETA2, v7.2.0-RC1, v7.2.1, v7.2.3, v7.2.4, v7.2.6, v7.2.7, v7.2.8, v7.2.9, v7.3.0, v7.3.0-BETA1, v7.3.0-BETA2, v7.3.0-RC1, v7.3.1, v7.3.10, v7.3.2, v7.3.3, v7.3.4, v7.3.5, v7.3.8, v7.3.9, v7.4.0, v7.4.0-BETA1, v7.4.0-RC1, v7.4.0-RC2, v7.4.1, v7.4.11, v7.4.3, v7.4.4, v7.4.6, v7.4.8, v7.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.4.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v7.1.0",
"v7.1.1",
"v7.1.10",
"v7.1.11",
"v7.1.2",
"v7.1.3",
"v7.1.4",
"v7.1.5",
"v7.1.6",
"v7.1.7",
"v7.1.8",
"v7.2.0",
"v7.2.0-BETA1",
"v7.2.0-BETA2",
"v7.2.0-RC1",
"v7.2.1",
"v7.2.3",
"v7.2.4",
"v7.2.6",
"v7.2.7",
"v7.2.8",
"v7.2.9",
"v7.3.0",
"v7.3.0-BETA1",
"v7.3.0-BETA2",
"v7.3.0-RC1",
"v7.3.1",
"v7.3.10",
"v7.3.2",
"v7.3.3",
"v7.3.4",
"v7.3.5",
"v7.3.8",
"v7.3.9",
"v7.4.0",
"v7.4.0-BETA1",
"v7.4.0-RC1",
"v7.4.0-RC2",
"v7.4.1",
"v7.4.11",
"v7.4.3",
"v7.4.4",
"v7.4.6",
"v7.4.8",
"v7.4.9"
]
}From 8.0.0 before 8.0.12
Fixed in 8.0.12
8 explicitly affected versions
v8.0.0, v8.0.1, v8.0.11, v8.0.3, v8.0.4, v8.0.6, v8.0.8, v8.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v8.0.0",
"v8.0.1",
"v8.0.11",
"v8.0.3",
"v8.0.4",
"v8.0.6",
"v8.0.8",
"v8.0.9"
]
}From 7.1.0 before 7.4.12
Fixed in 7.4.12
57 explicitly affected versions
v7.1.0, v7.1.1, v7.1.10, v7.1.11, v7.1.2, v7.1.3, v7.1.4, v7.1.5, v7.1.6, v7.1.7, v7.1.8, v7.1.9, v7.2.0, v7.2.0-BETA1, v7.2.0-BETA2, v7.2.0-RC1, v7.2.1, v7.2.2, v7.2.3, v7.2.4, v7.2.5, v7.2.6, v7.2.7, v7.2.8, v7.2.9, v7.3.0, v7.3.0-BETA1, v7.3.0-BETA2, v7.3.0-RC1, v7.3.1, v7.3.10, v7.3.11, v7.3.2, v7.3.3, v7.3.4, v7.3.5, v7.3.6, v7.3.7, v7.3.8, v7.3.9, v7.4.0, v7.4.0-BETA1, v7.4.0-BETA2, v7.4.0-RC1, v7.4.0-RC2, v7.4.0-RC3, v7.4.1, v7.4.10, v7.4.11, v7.4.2, v7.4.3, v7.4.4, v7.4.5, v7.4.6, v7.4.7, v7.4.8, v7.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "7.1.0"
},
{
"fixed": "7.4.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v7.1.0",
"v7.1.1",
"v7.1.10",
"v7.1.11",
"v7.1.2",
"v7.1.3",
"v7.1.4",
"v7.1.5",
"v7.1.6",
"v7.1.7",
"v7.1.8",
"v7.1.9",
"v7.2.0",
"v7.2.0-BETA1",
"v7.2.0-BETA2",
"v7.2.0-RC1",
"v7.2.1",
"v7.2.2",
"v7.2.3",
"v7.2.4",
"v7.2.5",
"v7.2.6",
"v7.2.7",
"v7.2.8",
"v7.2.9",
"v7.3.0",
"v7.3.0-BETA1",
"v7.3.0-BETA2",
"v7.3.0-RC1",
"v7.3.1",
"v7.3.10",
"v7.3.11",
"v7.3.2",
"v7.3.3",
"v7.3.4",
"v7.3.5",
"v7.3.6",
"v7.3.7",
"v7.3.8",
"v7.3.9",
"v7.4.0",
"v7.4.0-BETA1",
"v7.4.0-BETA2",
"v7.4.0-RC1",
"v7.4.0-RC2",
"v7.4.0-RC3",
"v7.4.1",
"v7.4.10",
"v7.4.11",
"v7.4.2",
"v7.4.3",
"v7.4.4",
"v7.4.5",
"v7.4.6",
"v7.4.7",
"v7.4.8",
"v7.4.9"
]
}From 8.0.0 before 8.0.12
Fixed in 8.0.12
12 explicitly affected versions
v8.0.0, v8.0.1, v8.0.10, v8.0.11, v8.0.2, v8.0.3, v8.0.4, v8.0.5, v8.0.6, v8.0.7, v8.0.8, v8.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.12"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v8.0.0",
"v8.0.1",
"v8.0.10",
"v8.0.11",
"v8.0.2",
"v8.0.3",
"v8.0.4",
"v8.0.5",
"v8.0.6",
"v8.0.7",
"v8.0.8",
"v8.0.9"
]
}References
- https://github.com/symfony/symfony/security/advisories/GHSA-j8gj-9rm5-4xhx
- https://github.com/symfony/symfony/commit/5ba145dba702404801bdf9e7e8d6df170060d541
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2026-45074.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45074.yaml
- https://github.com/symfony/symfony
- https://symfony.com/cve-2026-45074