CVE-2021-41268: 
PHP vulnerability analysis and mitigation

CVE-2021-41268 affects Symfony/SecurityBundle, the security system for Symfony PHP framework. The vulnerability was discovered in version 5.3.0 and fixed in version 5.3.12, released on November 24, 2021. The issue affects the Remember Me cookie functionality, where the cookie is not invalidated when a user changes their password (Symfony Advisory).

The vulnerability stems from a rework of the Remember Me cookie functionality in Symfony 5.3.0. When a user changes their password, the existing Remember Me cookie remains valid instead of being invalidated. This occurs because the password is not included in the cookie's signature, allowing continued access to the account even after password changes (Symfony Advisory).

An attacker who has previously obtained a valid Remember Me cookie can maintain access to the affected account even after the user changes their password. This persistence of access undermines the security measure of password changes, potentially allowing unauthorized access to user accounts (Symfony Advisory).

The vulnerability can be exploited if an attacker has managed to obtain a valid Remember Me cookie through a successful login. Once obtained, this cookie remains valid even after the legitimate user changes their password (Symfony Advisory).

The issue was fixed in Symfony version 5.3.12 by making the password part of the cookie's signature by default. This ensures that when a password is changed, the Remember Me cookie becomes invalid. Users should upgrade to version 5.3.12 or later to implement this fix (Symfony Advisory, Symfony Commit).