CVE-2026-45069 Details
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
A vulnerability exists in Symfony's OidcTokenHandler, which is responsible for validating OpenID Connect JWTs. In versions prior to 6.4.40, 7.4.12, and 8.0.12, the verifyClaims() method registered checkers for the audience (aud), issuer (iss), and expiry (exp) claims but failed to pass the mandatory claims list to the ClaimCheckerManager. As a result, a validly signed JWT that omitted these claims could pass verification. This issue has been addressed by ensuring that the OidcTokenHandler now includes the mandatory claims when calling the ClaimCheckerManager, thereby rejecting tokens missing the aud, iss, or exp claims.
Users can upgrade to Symfony versions 6.4.40, 7.4.12, or 8.0.12 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/symfony/symfony/releases/tag/v6.4.40 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v7.4.12 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v8.0.12 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/security/advisories/GHSA-29fc-p6c4-24cg | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1287 | Improper Validation of Specified Type of Input | [email protected] |
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sensiolabs symfony | >= 6.3.0, < 6.4.40 >= 7.4.0, < 7.4.12 >= 8.0.0, < 8.0.12 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | [email protected] |