CVE-2026-118513 in Symfony
Summary
by MITRE • 11/04/2026
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary user of the application, including a privileged one, following an incomplete fix for CVE-2026-45063. X509Authenticator extracts the user identifier from the Subject DN (Distinguished Name) that the web server passes in $_SERVER['SSL_CLIENT_S_DN']. The fix for CVE-2026-45063 anchored that extraction to an RDN (Relative Distinguished Name) boundary, but the regular expression used was not escape-aware. The expression runs against an already serialized DN, so it cannot tell an RDN separator from a separator character that occurs inside a value. Under RFC 2253, used by Apache and by nginx's $ssl_client_s_dn, a comma inside a value is escaped as \, and the expression reads it as a separator regardless. RFC 2253 also does not treat / as a separator, so it leaves it bare inside a value, while the expression treats every / as one. The legacy X509_NAME_oneline() format, used by Apache's LegacyDNStringFormat and by nginx's $ssl_client_s_dn_legacy, is the mirror image: it escapes / as \/ and leaves , bare. In that format, a certificate with no emailAddress attribute, or whose poisoned CN precedes it, authenticates as the smuggled address.
To cover both RFC 2253 and the legacy X509_NAME_oneline() format, X509Authenticator and X509AuthenticationListener now split the DN into RDNs before looking for the attribute, instead of matching the attribute against the serialized string. They select the separator from the serialization, split on unescaped occurrences of that separator only, unescape each RDN afterwards with the rules of its format, and require the attribute to span a whole RDN. The accepted value grammar is unchanged.
Applications that pass a per-attribute user key (such as SSL_CLIENT_S_DN_Email) and deployments whose CA generates or validates the subject are not affected by this vulnerability.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The Symfony framework contains a critical authentication bypass vulnerability within its X509Authenticator and X509AuthenticationListener components, affecting versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. This flaw represents an incomplete fix for the previously identified CVE-2026-45063 and allows attackers holding a certificate issued by the application's trusted Certificate Authority to authenticate as arbitrary users, including those with privileged roles. The vulnerability stems from how the authenticator extracts user identifiers from the Subject Distinguished Name passed via server variables such as $_SERVER['SSL_CLIENT_S_DN']. While previous patches attempted to anchor extraction to Relative Distinguished Name boundaries using regular expressions, these implementations failed to account for escape sequences inherent in certificate string serialization formats.
The technical root cause lies in a failure to correctly parse escaped characters within the serialized Distinguished Name strings. Under RFC 2253, which is utilized by Apache and nginx's $ssl_client_s_dn variable, commas inside attribute values are escaped with backslashes as \,, yet the vulnerable regular expression interprets these escaped commas as separators between RDNs. Similarly, forward slashes are not treated as separators in RFC 2253 but remain bare within values; however, the flawed regex treats every slash as a separator. Conversely, the legacy X509_NAME_oneline() format used by Apache's LegacyDNStringFormat and nginx's $ssl_client_s_dn_legacy exhibits inverse behavior: it escapes slashes as \/ while leaving commas unescaped. In this scenario, an attacker can craft a certificate where a poisoned Common Name precedes an emailAddress attribute or contains no such attribute at all, effectively smuggling the desired user identifier into the authentication flow by exploiting these parsing inconsistencies.
This vulnerability maps directly to CWE-287: Improper Authentication and CWE-601: URL Redirection to Untrusted Site in certain contexts of input validation failure, as it involves a fundamental breakdown in verifying the integrity of identity claims derived from X509 certificates. From an ATT&CK perspective, this aligns with T1078: Valid Accounts, specifically allowing attackers to leverage legitimate credentials or certificate properties to gain unauthorized access without needing to steal secrets through traditional means like phishing or brute force. The operational impact is severe because it allows privilege escalation and impersonation of any user within the application ecosystem, potentially leading to data exfiltration, lateral movement, and complete compromise of system integrity if administrative accounts are targeted.
The resolution implemented in subsequent versions addresses these parsing flaws by fundamentally changing how Distinguished Names are processed rather than relying on fragile regular expressions against serialized strings. The updated X509Authenticator and X509AuthenticationListener components now split the DN into RDNs based on unescaped occurrences of the appropriate separator character determined by the serialization format, whether RFC 2253 or legacy X509_NAME_oneline(). After splitting, each RDN is properly unescaped according to its specific format rules before checking if the target attribute spans a whole RDN. This approach ensures that escape sequences are respected and prevents attackers from injecting malicious identifiers through escaped separators.
Organizations utilizing Symfony for application development must immediately upgrade to patched versions of the framework components mentioned above. It is important to note that applications which pass per-attribute user keys, such as SSL_CLIENT_S_DN_Email directly, or deployments where the Certificate Authority strictly generates and validates subject fields without allowing end-user influence over DN structures, are not affected by this specific vector. However, given the severity of authentication bypass vulnerabilities, all systems relying on X509 client certificate authentication should be audited for proper configuration and updated to mitigate risks associated with malformed or maliciously crafted certificates from trusted CAs.