CVE-2026-45074CWE-290

Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay

High · published July 14, 2026

CVSS v4.0
7.6
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00488 · 41.2th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-07-14T17:49Z
EPSS history
Timeline
  • 14 JUL 17:49Z
    Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
    cvelistv5