Symfony: Programmatic Logins Skip the checkPostAuth() Method of User Checkers

Summary

CVE	CVE-2026-123746
State	PUBLISHED
Assigner	Checkmarx
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-11-06 13:17:29 UTC
Updated	2026-11-06 21:40:43 UTC
Description	The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. AuthenticatorManager::authenticateUser() is used by UserAuthenticatorInterface::authenticateUser() and by the SecurityBundle’s Security::login() to authenticate a user programmatically, but it does not dispatch the security.authentication.success event, on which checkPostAuth() runs. The fix for CVE-2024-50341 made Security::login() call checkPreAuth(), but checkPostAuth() was still skipped. As a result, an account rejected by a custom user checker in checkPostAuth() is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically. Applications are affected when they use a custom user checker that rejects users in checkPostAuth() and authenticate users programmatically, for example after a password reset or an e-mail verification link. A user whose account is rejected can then obtain an authenticated session through that flow. The default user checker does nothing in checkPostAuth(), so the default configuration is not affected. The fix makes AuthenticatorManager::authenticateUser() dispatch the security.authentication.success event once the token is created and before it is stored, as authentications through the firewall do, so that checkPostAuth() runs and can reject the user.

Risk And Classification

Primary CVSS: v4.0 2.3 LOW from 596c5446-0ce5-4ba2-aa66-48b3b757a647

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS: 0.002790000 probability, percentile 0.204520000 (date 2026-11-07)

Problem Types: CWE-288 | CWE-288 CWE-288 Authentication bypass using an alternate path or channel

Version	Source	Type	Score	Severity	Vector
4.0	596c5446-0ce5-4ba2-aa66-48b3b757a647	Secondary	2.3	LOW	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C...`
4.0	CNA	CVSS	2.3	LOW	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N`

CVSS v4.0 Breakdown

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

Low

User Interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Sub Conf.

None

Sub Integrity

None

Sub Availability

None

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Sensiolabs	Symfony	affected 5.4.56 git	Not specified
CNA	Sensiolabs	Symfony	affected 6.0.0 6.4.50 git	Not specified
CNA	Sensiolabs	Symfony	affected 7.0.0 7.4.23 git	Not specified
CNA	Sensiolabs	Symfony	affected 8.0.0 8.1.11 git	Not specified

References

Reference	Source	Link	Tags
github.com/symfony/symfony/security/advisories/GHSA-8f57-m8wj-x65w	596c5446-0ce5-4ba2-aa66-48b3b757a647	github.com
github.com/symfony/symfony/commit/af0aae5012beedf0a0c3fd581fd8b9ef696240c4	596c5446-0ce5-4ba2-aa66-48b3b757a647	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Discovery Credit

CNA: Nicolas Grekas (en)

CNA: Vincent Cassiau from CyberVanguard (en)

There are currently no legacy QID mappings associated with this CVE.