CVE-2026-123746

What it is

The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user checker’s checkPostAuth() method when a user is authenticated programmatically, allowing an account rejected by a custom user checker, such as an expired account, to be authenticated in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. AuthenticatorManager::authenticateUser() is used by UserAuthenticatorInterface::authenticateUser() and by the SecurityBundle’s Security::login() to authenticate a user programmatically, but it does not dispatch the security.authentication.success event, on which checkPostAuth() runs. The fix for CVE-2024-50341 made Security::login() call checkPreAuth(), but checkPostAuth() was still skipped. As a result, an account rejected by a custom user checker in checkPostAuth() is refused by form login and the other authenticators of the firewall, but can still be authenticated programmatically. Applications are affected when they use a custom user checker that rejects users in checkPostAuth() and authenticate users programmatically, for example after a password reset or an e-mail verification link. A user whose account is rejected can then obtain an authenticated session through that flow. The default user checker does nothing in checkPostAuth(), so the default configuration is not affected. The fix makes AuthenticatorManager::authenticateUser() dispatch the security.authentication.success event once the token is created and before it is stored, as authentications through the firewall do, so that checkPostAuth() runs and can reject the user.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. Limited direct impact.

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-11-06 12:36 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-11-06 12:36 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: not scored yet.
• Severity: 2.3 LOW (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2026-11-06 12:36 UTC

Last modified

2026-11-06 12:36 UTC

Weakness

CWE-288

Record status

Received

Affected

• Sensiolabs Symfony < 5.4.56
• Sensiolabs Symfony < 6.4.50
• Sensiolabs Symfony < 7.4.23

Attack profile CVSS 4.0 · 2.3

Attack vector

Network

Complexity

Low

Attack requirements

Present

Privileges needed

Low

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2026-123746.md and follow it. Check whether this project is affected by CVE-2026-123746. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge