Authentication Bypass in Symfony Framework via Host Header

Executive Summary

CVE-2026-45074 is a vulnerability in the Symfony PHP framework, specifically in the Cas2Handler class within the security-http component. The issue occurs when the CAS (Central Authentication Service) service URL is constructed using the HTTP Host header from the client request.

If the Symfony application does not configure the framework.trusted_hosts setting (which is the default state), an attacker can manipulate the Host header. This allows the attacker to replay a victim's CAS ticket from another application registered with the same CAS server, effectively authenticating as the victim in the Symfony application.

The vulnerability is classified under CWE-290 (Authentication Bypass by Spoofing) and has been fixed by requiring explicit configuration of trusted hosts. Without this configuration, the system now throws a LogicException to prevent the attack.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your system, you need to check if your Symfony application is using the CAS authentication component (Cas2Handler) and whether the `framework.trusted_hosts` configuration is missing or improperly set. The vulnerability exists if the application relies on the Host header to build the CAS service URL without validating trusted hosts.

• Check your Symfony configuration files (e.g., config/packages/framework.yaml) for the presence of the `trusted_hosts` setting under the `framework` key. If it is absent or empty, the application is vulnerable.
• Review your application's code for usage of `Cas2Handler` or CAS authentication. Look for instances where the service URL is constructed without explicit trusted host validation.
• Test for the vulnerability by sending a request with a manipulated Host header to your Symfony application. If the application accepts the request without throwing a `SuspiciousOperationException` or `LogicException`, it may be vulnerable. Example command using curl:
• curl -H "Host: malicious.example.com" http://your-symfony-app.example.com
• Monitor logs for exceptions related to `SuspiciousOperationException` or `LogicException` when accessing CAS-protected routes. The absence of such exceptions may indicate a vulnerable configuration.

Useful 0 Not Useful 0

Impact Analysis

If your Symfony application uses CAS authentication and does not configure the framework.trusted_hosts setting, this vulnerability could allow an attacker to:

• Impersonate legitimate users by replaying their CAS tickets.
• Gain unauthorized access to sensitive areas of your application.
• Perform actions on behalf of victims, such as accessing or modifying their data.

This could lead to data breaches, unauthorized transactions, or other malicious activities depending on the privileges of the compromised accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with several standards and regulations, including:

• GDPR (General Data Protection Regulation): Unauthorized access to user data due to this vulnerability could result in a data breach, leading to non-compliance with GDPR's data protection requirements. Organizations may face fines or legal consequences if personal data is exposed.
• HIPAA (Health Insurance Portability and Accountability Act): If the affected application handles protected health information (PHI), unauthorized access could violate HIPAA's security and privacy rules, resulting in penalties and reputational damage.
• PCI DSS (Payment Card Industry Data Security Standard): If the application processes payment card data, this vulnerability could lead to unauthorized access, violating PCI DSS requirements and potentially resulting in fines or loss of payment processing capabilities.

Failure to address this vulnerability may also violate internal security policies or industry-specific regulations, depending on the nature of the data and the organization's compliance obligations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-45074, follow these immediate steps:

• Upgrade your Symfony application to version 7.4.12 or 8.0.12, which includes the fix for this vulnerability. This ensures that the `Cas2Handler` class enforces trusted host validation.
• Configure the `framework.trusted_hosts` setting in your Symfony application. This setting should include all trusted hostnames or IP addresses that your application is allowed to accept. Example configuration in config/packages/framework.yaml:
• framework:
• trusted_hosts: ['^your-domain\.example\.com$', '^localhost$']
• Alternatively, use `Request::setTrustedHosts()` in your application code to dynamically set trusted hosts.
• Verify that your application rejects requests with spoofed Host headers by testing with manipulated headers. The application should throw a `SuspiciousOperationException` for untrusted hosts.
• If upgrading is not immediately possible, apply the patch manually by modifying the `Cas2Handler` class to enforce trusted host validation, as described in Resource 1.

Useful 0 Not Useful 0