This vulnerability arises when Symfony's AuthenticatorManager::authenticateUser skips the firewall user checker's checkPostAuth() routine during programmatic login. Because the post‑authentication check is never invoked, accounts that a custom user checker intends to reject—such as expired or suspended users—can still obtain an authenticated session. The weakness is CWE‑288, and the potential impact is unauthorized access or privilege escalation when the application relies on programmatic sign‑ins for sensitive operations.

The flaw affects applications built with Symfony up to and including 5.4.55, 6.x up to 6.4.49, 7.x up to 7.4.22, and 8.x up to 8.1.10. Users of earlier Symfony releases must update to 5.4.56 or later, 6.4.50 or later, 7.4.23 or later, or 8.1.11 or later to receive the fix.

The CVSS base score of 2.3 indicates low overall risk, and EPSS is not available for this list, suggesting limited evidence of active exploitation. The vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is an application or system that allows programmatic authentication—such as password‑reset or email‑verification flows—containing a custom checker that rejects users only in checkPostAuth(). An attacker exploiting this flaw could authenticate a rejected account via such flows, bypassing the intended security constraint.