From Symfony 7.1.0 up to but not including 7.4.12 and prior to 8.0.12, the Cas2Handler component constructs the CAS service URL by invoking Request::getSchemeAndHttpHost(). This value incorporates the Host header, which an attacker can manipulate when the framework.trusted_hosts setting is not configured. If a separate application registered with the same CAS server accepts tickets, the attacker can send a request with a forged Host header pointing to that application and replay a victim’s CAS ticket against the Symfony application. A successful replay authenticates the attacker using the victim’s credentials, enabling Cross‑Service Ticket Replay. The flaw maps to CWE‑290, reflecting improper authentication. The vulnerability is remedied in Symfony 7.4.12 and 8.0.12.

The vulnerability affects Symfony components security-http and symfony in releases from 7.1.0 up to but not including 7.4.12 and from 8.0.0 up to but not including 8.0.12. These vulnerable versions are susceptible because Cas2Handler does not validate the Host header against trusted values.

With a CVSS score of 7.6 the issue is classified as high severity, while the EPSS score of less than 1% indicates a low probability of exploitation currently. The flaw is not listed in CISA’s KEV catalog. An attacker can exploit it by crafting HTTP requests that set a Host header pointing to another application registered with the same CAS server, thereby replaying a victim ticket. The vulnerability is remote and does not require local code execution, but it does require header manipulation and a valid CAS ticket for the target application.