Improper Verification of Cryptographic Signature Affecting symfony/security-http package, versions >=6.3.0-BETA1, <6.4.40>=7.4.0-BETA1, <7.4.12>=8.0.0-BETA1, <8.0.12

symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via claim validation in OidcTokenHandler::verifyClaims(). An attacker can authenticate using a validly signed JWT that omits required claims such as aud, iss, and exp, because ClaimCheckerManager::check() is invoked without the $mandatoryClaims argument, causing absent claims to bypass validation entirely.

• GitHub Commit
• Symfony Advisory