Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-121971— Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

Quick assessment

Affected
sensiolabs symfony
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Symfony 的 HttpClient 组件中的 在将默认作用域（例如 或 ）的选项合并到请求之前，会先解析相对 URL 相对于 的路径。这一处理顺序使得攻击者可以利用网络路径引用（例如 ），将请求发送到另一个域名，同时携带默认作用域的凭据，从而导致这些凭据泄露到由攻击者控制的服务器。 该漏洞影响以下 Symfony 版本： 5.x 版本中低于 5.4.56 的版本； 6.x 版本中低于 6.4.50 的版本； 7.x 版本中低于 7.4.23 的版本； 8.x 版本中低于 8.1.11 的版本。 具体表现为：解

CVSS 8.2 · High

Affected Version Matrix 4

VendorProduct Version RangeStatus
sensiolabs symfony < 5.4.56 affected
6.0.0< 6.4.50 affected
7.0.0< 7.4.23 affected
8.0.0< 8.1.11 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-121971

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
Source: CVE Program / CVE List V5
Vulnerability Description
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together with the default scope’s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server. This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host. This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.http_client.scoped_clients. To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sensiolabs symfony 0 ~ 5.4.56 -

II. Public POCs for CVE-2026-121971

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-121971

请登录查看更多情报信息。

Other References for CVE-2026-121971 (2)

Same Patch Batch · sensiolabs · 2026-11-04 · 4 CVEs total

CVE-2026-118513 7.7 HIGH Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE
CVE-2026-118516 6.3 MEDIUM Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypas
CVE-2026-121373 5.3 MEDIUM Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the B

IV. Related Vulnerabilities

Same product: symfony
Same vendor: sensiolabs
Same weakness: CWE-200