CVE-2026-123746— Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

Quick assessment

Affected

sensiolabs symfony

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Symfony 安全 HTTP 组件中的方法在通过编程方式认证用户时，未执行防火墙用户检查器的方法。这导致在 Symfony 5.4.56 之前、6.x 系列 6.4.50 之前、7.x 系列 7.4.23 之前以及 8.x 系列 8.1.11 之前的版本中，被自定义用户检查器（例如已过期账户）拒绝的账户仍可被成功认证。方法由以及 SecurityBundle 中的调用，用于以编程方式认证用户；然而，该方法并未触发事件，而正是在该事件中执行的。针对 CVE-2024-50341 的修复使调用了，但

CVSS 2.3 · Low Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1551.004

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

Source: CVE Program / CVE List V5

Vulnerability Description

The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. AuthenticatorManager::authenticateUser() is used by UserAuthenticatorInterface::authenticateUser() and by the SecurityBundle’s Security::login() to authenticate a user programmatically, but it does not dispatch the security.authentication.success event, on which checkPostAuth() runs. The fix for CVE-2024-50341 made Security::login() call checkPreAuth(), but checkPostAuth() was still skipped. As a result, an account rejected by a custom user checker in checkPostAuth() is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically. Applications are affected when they use a custom user checker that rejects users in checkPostAuth() and authenticate users programmatically, for example after a password reset or an e-mail verification link. A user whose account is rejected can then obtain an authenticated session through that flow. The default user checker does nothing in checkPostAuth(), so the default configuration is not affected. The fix makes AuthenticatorManager::authenticateUser() dispatch the security.authentication.success event once the token is created and before it is stored, as authentications through the firewall do, so that checkPostAuth() runs and can reject the user.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用候选路径或通道进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
sensiolabs	symfony	0 ~ 5.4.56	-

II. Public POCs for CVE-2026-123746

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123746

请登录查看更多情报信息。

Other References for CVE-2026-123746 (2)

https://github.com/symfony/symfony/security/advisories/GHSA-8f57-m8wj-x65w third-party-advisory
https://github.com/symfony/symfony/commit/af0aae5012beedf0a0c3fd581fd8b9ef696240c4 patch

https://www.cve.org/CVERecord?id=CVE-2026-123746

Same Patch Batch · sensiolabs · 2026-11-06 · 7 CVEs total

CVE-2026-123792	8.7 HIGH	Symfony: Exponential and Quadratic Parse Times in the YAML Parser Let a Single Document Ho
CVE-2026-118515	8.4 HIGH	Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Po
CVE-2026-121623	8.2 HIGH	Symfony: DataUriNormalizer Opens Data URIs With a Non-Lowercase Scheme as Local Files, Let
CVE-2026-122053	6.9 MEDIUM	Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested
CVE-2026-123339	2.3 LOW	Symfony: Inline Fragments Let Untrusted Forwarded Headers Set the Host, Scheme and Port of
CVE-2026-123824	2.3 LOW	Symfony: XXE (Local File Read) in Config XmlUtils::parse() via validateOnParse = true

IV. Related Vulnerabilities

Same product: symfony

Same vendor: sensiolabs

Same weakness: CWE-288