Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The vulnerability is found in the security components’ OidcTokenHandler::verifyClaims() method. Before releases 6.4.40, 7.4.12, and 8.0.12, this method registered the audience (aud), issuer (iss), and expiry (exp) checkers but failed to include the mandatory claims list when delegating verification to ClaimCheckerManager::check. Consequently, a properly signed JWT that omitted those mandatory claims could be accepted as valid, allowing an attacker to gain unauthorized access or impersonate a legitimate user.

Symfony components security-http and symfony are affected. Versions prior to 6.4.40, 7.4.12, and 8.0.12 are vulnerable and should be upgraded to the corresponding patched releases.

The CVSS score of 8.8 indicates a high impact vulnerability. The EPSS score of less than 1% points to a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it by supplying a correctly signed JWT missing required claims to any application that uses the unpatched OidcTokenHandler for token validation.