CVE-2026-45063

Symfony’s X509Authenticator extracts the user identifier from the server variable $_SERVER['SSL_CLIENT_S_DN'] using an unanchored regular expression that matches the substring emailAddress= anywhere in the distinguished name. Because the regex is not anchored, an attacker who can present a trusted client certificate can embed the victim’s email address within another relative distinguished name, such as the common name field, and the authenticator will treat that value as the user. As a result, the attacker can authenticate as the victim without needing additional privileges or executing code, leading to full impersonation of the victim account.

Affected installations are Symfony framework versions 5.4, 6.4, 7.4, and 8.0 that are earlier than releases 5.4.52, 6.4.40, 7.4.12, and 8.0.12 respectively. Any application that employs X509Authenticator to map client certificate distinguished names to users is vulnerable. The flaw is present in the Symfony component package symfony:symfony and applies to web and console applications built with Symfony.

The CVSS score of 9.1 rates this issue as critical, reflecting its potential for complete authentication bypass. The EPSS score of less than 1% indicates that exploitation is currently unlikely, and the vulnerability is not yet listed in CISA's KEV catalog. However, an attacker with a client certificate capable of forging the distinguished name can exploit this vulnerability without needing additional privileges or remote code execution; they merely need to supply the crafted certificate to the application’s X509 authentication flow.