CyberRota Analysis
AI-GeneratedThe vulnerability in Symfony allows a validly signed JWT to bypass verification if it omits mandatory claims such as audience, issuer, and expiry, potentially leading to unauthorized access or privilege escalation. Organizations using affected versions of Symfony (prior to 6.4.40, 7.4.12, and 8.0.12) should prioritize updating to the patched versions to mitigate this critical security risk. This issue is particularly relevant for developers and security teams managing web applications built on the Symfony framework.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)