Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to Symfony 5.4.53, 6.4.41, 7.4.13 and 8.0.13, DefaultAuthenticationFailureHandler honored the request‑supplied _failure_path parameter when the failure_forward option was enabled. This allowed an unauthenticated login request that failed to dispatch a sub‑request to an access_control‑protected GET route, thereby bypassing firewall listeners and granting unauthorized access to resources that should have been restricted. The vulnerability is a missing authorization flaw, identified by CWE‑863.

Versions of the Symfony framework and security‑http component older than 5.4.53, 6.4.41, 7.4.13, and 8.0.13 are affected. Any deployment of Symfony that relies on the default authentication failure handler and has failure_forward is vulnerable. The issue is present in both the Symfony framework package and the security‑http component.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score of less than 1 % indicates that the probability of exploitation is currently very low, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves unauthenticated HTTP traffic that includes the failure_forward configuration and supplies an _failure_path parameter pointing at a protected GET route. The subrequest bypasses the firewall listeners, giving the attacker unauthorized access to protected resources.