CVE-2026-123746— Symfony 认证绕过漏洞
一分钟漏洞结论
影响对象
sensiolabs symfony
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Symfony 安全 HTTP 组件中的 方法在通过编程方式认证用户时，未执行防火墙用户检查器的 方法。这导致在 Symfony 5.4.56 之前、6.x 系列 6.4.50 之前、7.x 系列 7.4.23 之前以及 8.x 系列 8.1.11 之前的版本中，被自定义用户检查器（例如已过期账户）拒绝的账户仍可被成功认证。 方法由 以及 SecurityBundle 中的 调用，用于以编程方式认证用户；然而，该方法并未触发 事件，而 正是在该事件中执行的。针对 CVE-2024-50341 的修复使 调用了 ，但
可能的 ATT&CK 技术 1 AI
T1551.004
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-123746 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers
来源: CVE Program / CVE List V5
Vulnerability Description
The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
AuthenticatorManager::authenticateUser() is used by UserAuthenticatorInterface::authenticateUser() and by the SecurityBundle’s Security::login() to authenticate a user programmatically, but it does not dispatch the security.authentication.success event, on which checkPostAuth() runs. The fix for CVE-2024-50341 made Security::login() call checkPreAuth(), but checkPostAuth() was still skipped. As a result, an account rejected by a custom user checker in checkPostAuth() is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically.
Applications are affected when they use a custom user checker that rejects users in checkPostAuth() and authenticate users programmatically, for example after a password reset or an e-mail verification link. A user whose account is rejected can then obtain an authenticated session through that flow. The default user checker does nothing in checkPostAuth(), so the default configuration is not affected.
The fix makes AuthenticatorManager::authenticateUser() dispatch the security.authentication.success event once the token is created and before it is stored, as authentications through the firewall do, so that checkPostAuth() runs and can reject the user.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
使用候选路径或通道进行的认证绕过
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| sensiolabs | symfony | 0 ~ 5.4.56 | - |
|
二、漏洞 CVE-2026-123746 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-123746 的情报信息
请登录查看更多情报信息。
CVE-2026-123746 其他参考 (2)
-
https://github.com/symfony/symfony/security/advisories/GHSA-8f57-m8wj-x65w third-party-advisory
同批安全公告 · sensiolabs · 2026-11-06 · 共 6 条
| CVE-2026-123792 | 8.7 HIGH | Symfony YAML 解析器拒绝服务漏洞 |
| CVE-2026-118515 | 8.4 HIGH | Symfony 任意文件上传漏洞 |
| CVE-2026-121623 | 8.2 HIGH | Symfony DataUriNormalizer 任意文件读取漏洞 |
| CVE-2026-122053 | 6.9 MEDIUM | Symfony ObjectNormalizer 忽略属性路径遍历漏洞 |
| CVE-2026-123339 | 2.3 LOW | Symfony 4.4.40 远程请求伪造漏洞 |