CVE-2026-118513: Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary user of the application, including a privileged one, following an incomplete fix for CVE-2026-45063. X509Authenticator extracts the user identifier from the Subject DN (Distinguished Name) that the web server passes in $SERVER['SSLCLIENTSDN']. The fix for CVE-2026-45063 anchored that extraction to an RDN (Relative Distinguished Name) boundary, but the regular expression used was not escape-aware. The expression runs against an already serialized DN, so it cannot tell an RDN separator from a separator character that occurs inside a value. Under RFC 2253, used by Apache and by nginx's $sslclientsdn, a comma inside a value is escaped as \, and the expression reads it as a separator regardless. RFC 2253 also does not treat / as a separator, so it leaves it bare inside a value, while the expression treats every / as one. The legacy X509NAMEoneline() format, used by Apache's LegacyDNStringFormat and by nginx's $sslclientsdnlegacy, is the mirror image: it escapes / as \/ and leaves , bare. In that format, a certificate with no emailAddress attribute, or whose poisoned CN precedes it, authenticates as the smuggled address.
To cover both RFC 2253 and the legacy X509NAMEoneline() format, X509Authenticator and X509AuthenticationListener now split the DN into RDNs before looking for the attribute, instead of matching the attribute against the serialized string. They select the separator from the serialization, split on unescaped occurrences of that separator only, unescape each RDN afterwards with the rules of its format, and require the attribute to span a whole RDN. The accepted value grammar is unchanged.
Applications that pass a per-attribute user key (such as SSLCLIENTSDNEmail) and deployments whose CA generates or validates the subject are not affected by this vulnerability.
Other sources
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from the application's trusted CA who can influence the CN to authenticate as an arbitrary user of the application, including a privileged one, following an incomplete fix for CVE-2026-45063.X509Authenticator extracts the user identifier from the Subject DN (Distinguished Name) that the web server passes in $SERVER['SSLCLIENTSDN']. The fix for CVE-2026-45063 anchored that extraction to an RDN (Relative Distinguished Name) boundary, but the regular expression used was not escape-aware. The expression runs against an already serialized DN, so it cannot tell an RDN separator from a separator character that occurs inside a value. Under RFC 2253, used by Apache and by nginx's $sslclientsdn, a comma inside a value is escaped as \, and the expression reads it as a separator regardless. RFC 2253 also does not treat / as a separator, so it leaves it bare inside a value, while the expression treats every / as one. The legacy X509NAMEoneline() format, used by Apache's LegacyDNStringFormat and by nginx's $sslclientsdnlegacy, is the mirror image: it escapes / as \/ and leaves , bare. In that format, a certificate with no emailAddress attribute, or whose poisoned CN precedes it, authenticates as the smuggled address.
To cover both RFC 2253 and the legacy X509NAMEoneline() format, X509Authenticator and X509AuthenticationListener now split the DN into RDNs before looking for the attribute, instead of matching the attribute against the serialized string. They select the separator from the serialization, split on unescaped occurrences of that separator only, unescape each RDN afterwards with the rules of its format, and require the attribute to span a whole RDN. The accepted value grammar is unchanged.
Applications that pass a per-attribute user key (such as SSLCLIENTSDNEmail) and deployments whose CA generates or validates the subject are not affected by this vulnerability.
— MITRE
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.4.56 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.4.50 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.4.23 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.1.11
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Symfony's X509Authenticator or X509AuthenticationListener are exposed if they run versions earlier than 5.4.56, 6.4.50, 7.4.23, or 8.1.11 and derive the user identifier from the client certificate Subject DN passed by the web server in $_SERVER['SSL_CLIENT_S_DN'].
What does an attacker need to exploit the authentication bypass?
The attacker must hold a certificate issued by the application's trusted CA and be able to influence the certificate Common Name (CN). They can use DN value characters that are interpreted incorrectly during identifier extraction to impersonate an arbitrary application user, including a privileged user.
Does the affected web-server DN format matter?
Yes. The issue concerns serialized Subject DN handling, including RFC 2253 output used by Apache and nginx's $ssl_client_s_dn, where commas within values are escaped as \, but can still be treated as RDN separators by the vulnerable expression. The legacy X509_NAME_oneline() format is also referenced as an affected DN format.
How should teams remediate this issue?
Upgrade Symfony to 5.4.56, 6.4.50, 7.4.23, 8.1.11, or a later applicable release. Until upgraded, treat certificates from the trusted CA whose CN values can be attacker-controlled as capable of enabling account impersonation.