{"id":"GHSA-m2wj-r6g3-fxfx","aliases":["BIT-symfony-2023-46733","CVE-2023-46733"],"title":"Symfony possible session fixation vulnerability","description":"### Description\n\nSessionStrategyListener does not always migrate the session after a successful login. It only migrate the session when the logged-in user identifier changes. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations.\n\n### Resolution\n\nSymfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.\n\nThe patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74) for branch 5.4.\n\n### Credits\n\nWe would like to thank Robert Meijers for reporting the issue and providing the fix.","severity":"medium","score":6.5,"published":"2023-11-12T15:51:54.000Z","modified":"2026-09-10T03:50:04.290Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"symfony/security-http","ranges":[{"events":[{"introduced":"5.4.21"},{"fixed":"5.4.31"}],"type":"ECOSYSTEM"}],"versions":["v5.4.21","v5.4.22","v5.4.23","v5.4.26","v5.4.28","v5.4.30"],"fixed":["5.4.31"]},{"ecosystem":"Packagist","name":"symfony/security-http","ranges":[{"events":[{"introduced":"6.2.7"},{"fixed":"6.3.8"}],"type":"ECOSYSTEM"}],"versions":["v6.2.10","v6.2.11","v6.2.13","v6.2.7","v6.2.8","v6.3.0","v6.3.0-BETA1","v6.3.0-RC1","v6.3.1","v6.3.2","v6.3.4","v6.3.5","v6.3.6"],"fixed":["6.3.8"]},{"ecosystem":"Packagist","name":"symfony/symfony","ranges":[{"events":[{"introduced":"5.4.21"},{"fixed":"5.4.31"}],"type":"ECOSYSTEM"}],"versions":["v5.4.21","v5.4.22","v5.4.23","v5.4.24","v5.4.25","v5.4.26","v5.4.27","v5.4.28","v5.4.29","v5.4.30"],"fixed":["5.4.31"]},{"ecosystem":"Packagist","name":"symfony/symfony","ranges":[{"events":[{"introduced":"6.2.7"},{"fixed":"6.3.8"}],"type":"ECOSYSTEM"}],"versions":["v6.2.10","v6.2.11","v6.2.12","v6.2.13","v6.2.14","v6.2.7","v6.2.8","v6.2.9","v6.3.0","v6.3.0-BETA1","v6.3.0-BETA2","v6.3.0-BETA3","v6.3.0-RC1","v6.3.0-RC2","v6.3.1","v6.3.2","v6.3.3","v6.3.4","v6.3.5","v6.3.6","v6.3.7"],"fixed":["6.3.8"]}],"references":["https://github.com/symfony/symfony/security/advisories/GHSA-m2wj-r6g3-fxfx","https://nvd.nist.gov/vuln/detail/CVE-2023-46733","https://github.com/symfony/symfony/commit/7467bd7e3f888b333102bc664b5e02ef1e7f88b9","https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46733.yaml","https://github.com/symfony/symfony","https://symfony.com/cve-2023-46733"],"sources":[{"name":"OSV","id":"GHSA-m2wj-r6g3-fxfx","modified":"2026-09-10T03:50:04.290059815Z","url":"https://osv.dev/vulnerability/GHSA-m2wj-r6g3-fxfx"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","score":6.5}]}