Affected versions¶ Symfony >= 5.3.0, <5.3.2 versions of the Symfony Security HTTP component is affected by this security issue. The issue has been fixed in Symfony 5.3.2. Description¶ When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a user authenticated on one part of the application is considered authenticated on the whole application. We now ensure that the authenticated token is only available for the firewall that generates it. The patch for this issue is available here for branch 5.3. Credits¶ I would like to thank Bogdan, gndk, Paweł Warchoł, Warxcell, and Adrien Lamotte for reporting the issue and Wouter J for fixing the issue.
Sponsor the Symfony project.Login to add comment
Other posts in this group
SymfonyOnline June 2025 is almost here, starting in almost 2 months on:
June 10-11: Workshop days. It is possible to attend 1 two-day training or 2 one-day trainings. June 12-13: Online confe
Symfony security includes several significant improvements and new features in Symfony 7.3.
Deprecate eraseCredentials() Method… https://symfony.com/blog/new-in-symfony-7-3-security-improvements?utm_
SymfonyOnline June 2025 is almost here, starting in almost 2 months on:
June 10-11: Workshop days June 12-13: Online conference days in English. All talks will be available for replay as soon
Contributed by Antoine Bluchet in
Contributed by Nicolas Grekas in
This week, we published the second beta of Symfony 7.3, ahead of its final release later in May 2025. Meanwhile, we continued sharing posts about the new features of Symfony 7.3 and the upcoming Symfo
Symfony 7.3.0-BETA2 has just been released. This is a pre-release version of Symfony 7.3. If you want to test it in your own applications before its final release, run the following commands:
