Security Resilience

CVE-2026-45069

Sensiolabs Symfony 6.3.0 – 6.4.40

Published
14 July 2026
Modified
15 July 2026
Patch / advisory
View advisory
CVSS Score v4 8.8
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0026 16th percentile
Risk Priority 43 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-45069 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Sensiolabs Symfony. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked at the 16th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability Data

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims…

more

list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CWE(s)
CWE-345CWE-1287

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.001 Junk Data Command And Control
Adversaries may add junk data to protocols used for command and control to make detection more difficult.
attack.mitre.org →
T1003.001 LSASS Memory Credential Access
Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.005 Cached Domain Credentials Credential Access
Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1007 System Service Discovery Discovery
Adversaries may try to gather information about registered local system services.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-45133Same product: Sensiolabs Symfony
CVE-2026-48747Same product: Sensiolabs Symfony
CVE-2026-45304Same product: Sensiolabs Symfony
CVE-2026-45753Same product: Sensiolabs Symfony
CVE-2026-45070Same product: Sensiolabs Symfony
CVE-2026-45756Same product: Sensiolabs Symfony
CVE-2026-45305Same product: Sensiolabs Symfony
CVE-2026-47212Same product: Sensiolabs Symfony
CVE-2026-45755Same product: Sensiolabs Symfony
CVE-2026-45063Same product: Sensiolabs Symfony

Affected Assets

sensiolabs
symfony
6.3.0 — 6.4.40 · 7.4.0 — 7.4.12 · 8.0.0 — 8.0.12

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.1.1
  • V1.4.2
  • V2.1.1
  • V2.2.2

Mitigating Controls (NIST 800-53 r5) AI

SC-23 Session Authenticity good match

Explicit requirement to protect session authenticity structurally prevents the weakness for communications.

SI-10 Information Input Validation good match

SI-10 directly requires validation of information inputs, which structurally prevents type-validation failures from being introduced or exploitable.

SI-7 Software, Firmware, and Information Integrity good match

Integrity verification tools detect (but do not stop) the acceptance of data lacking authenticity.

SC-13 Cryptographic Protection partial match

Cryptographic mechanisms can be used to verify authenticity, thereby preventing acceptance of invalid data.

SC-16 Transmission of Security and Privacy Attributes partial match

Associating security attributes with exchanged information supports verification of authenticity.

SC-8 Transmission Confidentiality and Integrity partial match

Integrity protection on transmitted data directly stops acceptance of unauthenticated or altered data.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require proper input type validation during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.8.10 Information deletion partial match
removes

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

References