CVE-2026-45074: Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay
Cas2Handler builds this service parameter from Request::getSchemeAndHttpHost(), which reflects the attacker-controlled HTTP Host header whenever Symfony's framework.trustedhosts setting is not configured (the default). An attacker who controls any other application registered with the same CAS server can replay a victim's ticket against the Symfony application, with a spoofed Host header, and be authenticated as that victim.
Resolution
A new required serviceurl configuration option is introduced on Cas2Handler. The CAS service parameter sent to the validation endpoint is now built from this configured URL instead of being derived from the request's Host header, preventing cross-service ticket replay via Host header spoofing.
The patch for this issue is available here for branch 7.4.
Credits
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Nicolas Grekas for providing the fix.
Other sources
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trustedhosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
composer/symfony/security-httpto a version that resolves this vulnerability.Fixed in 8.0.12 - Upgrade
Upgrade
composer/symfony/security-httpto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfony Cas2Handlerto a version that resolves this vulnerability.Fixed in 7.4.12 - Upgrade
Upgrade
Symfony Cas2Handlerto a version that resolves this vulnerability.Fixed in 8.0.12 - Configuration
Set the new required Cas2Handler configuration option `service_url` so the CAS `service` parameter is built from this configured URL instead of being derived from the request `Host` header.
Symfony (Cas2Handler) service_url = required (configured URL)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45074?
The severity of CVE-2026-45074 is rated at 65.
How do I fix CVE-2026-45074?
To fix CVE-2026-45074, configure the 'framework.trusted_hosts' setting in your Symfony application.
Which versions of Symfony are affected by CVE-2026-45074?
CVE-2026-45074 affects versions of Symfony that do not have the 'framework.trusted_hosts' setting configured.
What kind of attack can CVE-2026-45074 facilitate?
CVE-2026-45074 can facilitate header injection attacks due to the reflection of the attacker-controlled HTTP 'Host' header.
Is CVE-2026-45074 relevant for all Symfony applications?
CVE-2026-45074 is particularly relevant for Symfony applications that have not configured the 'framework.trusted_hosts' setting.