CVE-2026-45069

Analyzed Analyzed - Analysis Complete

JWT Claim Verification Bypass in Symfony Framework

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45069

EUVD

EUVD-2026-44357

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	From 6.3.0 (inc) to 6.4.40 (exc)
sensiolabs	symfony	From 7.4.0 (inc) to 7.4.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1287	The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability affects Symfony's OidcTokenHandler, which validates bearer JWTs in OpenID Connect. The issue is that the handler registers checks for mandatory claims like audience (aud), issuer (iss), and expiry (exp) but fails to enforce them. A validly-signed JWT missing these claims can bypass verification, potentially allowing unauthorized access.

Detection Guidance

To detect this vulnerability, check the installed Symfony version using composer show symfony/security-http or composer show symfony/symfony. If the version is below 6.4.40, 7.4.12, or 8.0.12, the system is vulnerable. Review JWT validation logs for tokens missing aud, iss, or exp claims that were accepted.

Impact Analysis

An attacker could craft a JWT without required claims (aud, iss, exp) that still passes validation. This may lead to unauthorized access to protected resources or actions, compromising application security and data integrity.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating confidentiality requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to insufficient data authenticity verification.

Mitigation Strategies

Upgrade Symfony to versions 6.4.40, 7.4.12, or 8.0.12 or later immediately. If upgrading is not possible, implement custom claim validation in OidcTokenHandler to enforce aud, iss, and exp checks. Monitor JWT validation logs for suspicious tokens.

Hi! I’m here to help you understand CVE-2026-45069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70