Affected versions¶ Symfony >= 5.3.0, <5.3.2 versions of the Symfony Security HTTP component is affected by this security issue. The issue has been fixed in Symfony 5.3.2. Description¶ When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a user authenticated on one part of the application is considered authenticated on the whole application. We now ensure that the authenticated token is only available for the firewall that generates it. The patch for this issue is available here for branch 5.3. Credits¶ I would like to thank Bogdan, gndk, Paweł Warchoł, Warxcell, and Adrien Lamotte for reporting the issue and Wouter J for fixing the issue.
Sponsor the Symfony project.Login to add comment
Other posts in this group
Thank you for joining us at SymfonyOnline June 2025!
What a great edition of SymfonyOnline we’ve just wrapped up! 🎉
We were thrilled to welcome 300 participants from 35 different countries—a
This week, Symfony celebrated the SymfonyOnline June 2025 conference with great success. Meanwhile, development efforts focused on improving invokable commands for the upcoming Symfony 7.4 version. Th
This week, development activity focused on the upcoming Symfony 7.4 and 8.0 versions, which will deprecate and remove many features. In addition, we published a case study about Yousign. Finally, we'r
As digital signatures become the norm in modern business, Yousign has established itself as a trusted leader across Europe. Behind its simple, intuitive interface is a powerful technical engine, handl
Get ready for the exciting SymfonyOnline June 2025, kicking off in a few days only! There’s still time to register and join the international online Symfony conference—along with pre-conferenc
This week, Symfony released the stable version of Symfony 7.3, which includes lots of amazing new features. We also published the maintenance versions 6.4.22 and 7.2.7.
Symfony development highlights
This is the second part of the blog post showcasing the main DX (developer experience) features introduced in Symfony 7.3. Read the first part of this blog post.
Verify URI Signatures… https://symfon
