CVE-2026-121971: Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as authbearer or authbasic) into a request before resolving a relative URL against the baseuri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together with the default scope’s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server. This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.
The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host.
This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a baseuri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.httpclient.scopedclients.
To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Symfony HttpClientto a version that resolves this vulnerability.Fixed in 5.4.56 - Upgrade
Upgrade
Symfony HttpClientto a version that resolves this vulnerability.Fixed in 6.4.50 - Upgrade
Upgrade
Symfony HttpClientto a version that resolves this vulnerability.Fixed in 7.4.23 - Upgrade
Upgrade
Symfony HttpClientto a version that resolves this vulnerability.Fixed in 8.1.11
Event History
Frequently Asked Questions
Which applications are realistically exposed to credential disclosure?
Applications are exposed when they use a scoped Symfony HTTP client with a base_uri and default credentials, such as auth_bearer or auth_basic, and an attacker can control the beginning of a URL supplied to that client. This includes clients created with HttpClient::createForBaseUri() and clients configured through framework.http_client.scoped_clients.
What URL forms can trigger the issue?
A network-path reference such as //evil.example/steal can resolve to another origin while retaining credentials from the default scope. The issue also occurs when the resulting URL uses a different port or includes a user-info part on the same host; a fully absolute URL such as https://evil.example/steal does not receive the scoped options.
Are clients with a base URI affected by default?
A base_uri alone is not sufficient based on the available information. Exposure requires credentials configured in the default scope and attacker influence over the beginning of the URL passed to that scoped client.
How can teams identify potentially affected usage?
Review uses of ScopingHttpClient, HttpClient::createForBaseUri(), and framework.http_client.scoped_clients for configured auth_bearer or auth_basic options. Prioritize call paths where URL input can begin with // or otherwise introduce a different authority, port, or user-info component.
Which Symfony versions need remediation?
Affected versions are Symfony 5.x before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, and 8.x before 8.1.11. Upgrade to the applicable fixed release.