The ScopingHttpClient component in the Symfony HttpClient library merges the authentication options of its default scope into every request before resolving a relative URL against the base_uri. If a request URL contains a network‑path reference such as "//evil.example/steal", the merged credentials are inadvertently sent to the remote host, exposing bearer or basic auth credentials. This leads to an information‑exposure flaw that can compromise the confidentiality of the application's authentication data.

Sensiolabs Symfony is affected, specifically versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11 across the 5.x, 6.x, 7.x, and 8.x branches. All releases built on the HttpClient component that use a base_uri with credentials are susceptible to this issue.

The score is 8.2 on the CVSS scale, indicating high severity, but the EPSS score is unavailable so the current exploitation probability is unknown. The vulnerability is listed as not in the CISA KEV catalog, and no public exploits are known. It can be leveraged when an attacker controls the URL passed to a client configured with a base_uri and credentials, for example through user input or an API that builds relative URLs. If an attacker can supply a crafted relative URL that resolves to an external origin, they can capture the default scope credentials and use them for further attacks.