Authentication bypass is possible by crafting a certificate with a specially formatted subject DN. The vulnerability originates in Symfony’s X509Authenticator and X509AuthenticationListener, which incorrectly parsed the Distinguished Name string and could interpret separator characters inside values. This flaw allows an attacker who owns a certificate issued by the application’s trusted CA, and can influence the Common Name field, to authenticate as any user in the application, including privileged accounts. The flaw is a classic example of Authentication Bypass using externally‑controlled authentication material, identified as CWE‑290. The impact is non‑repudiation and privilege escalation through session hijacking, as the user identity is accepted without further verification.

The Symfony framework from the vendor sensiolabs:symfony is affected. Versions up to and including 5.4.55, 6.x below 6.4.50, 7.x below 7.4.23, and 8.x below 8.1.11 are vulnerable. Applications that rely on X509 client certificates for authentication and extract the user identifier from the SSL_CLIENT_S_DN server variable are at risk. Environments that pass a per‑attribute user key such as SSL_CLIENT_S_DN_Email or whose CA generates or validates the subject are not affected.

The vulnerability receives a CVSS v3 score of 7.7, indicating high severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, suggesting a lower documented exploitation probability but still significant risk to exposed systems. The attack vector is remote and requires control over a client certificate issued by the trusted CA. An attacker can manipulate the DN to cause the framework to identify an arbitrary user, bypassing normal authentication controls. Prompt patching is recommended because the flaw provides full authentication bypass with potential privilege escalation.