CVE-2026-45069
CRITICALSymfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims
Title source: cnaDescription
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
References (4)
Core 4
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/symfony/symfony/security/advisories/GHSA-29fc-p6c4-24cg
X_Refsource_Misc x_refsource_misc
https://github.com/symfony/symfony/releases/tag/v6.4.40
X_Refsource_Misc x_refsource_misc
https://github.com/symfony/symfony/releases/tag/v7.4.12
X_Refsource_Misc x_refsource_misc
https://github.com/symfony/symfony/releases/tag/v8.0.12
Scores
CVSS v3
9.1
EPSS
0.0024
EPSS Percentile
14.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-1287
CWE-345
Status
published
Products (7)
sensiolabs/symfony
6.3.0 - 6.4.40
symfony/security-http
>= 6.3.0, < 6.4.40
symfony/security-http
>= 7.4.0, < 7.4.12
symfony/security-http
>= 8.0.0-BETA1, < 8.0.12
symfony/symfony
>= 6.3.0, < 6.4.40
symfony/symfony
>= 7.4.0, < 7.4.12
symfony/symfony
>= 8.0.0-BETA1, < 8.0.12
Published
Jul 14, 2026
Tracked Since
Jul 15, 2026