CVE-2026-118513: 
PHP vulnerability analysis and mitigation

CVE-2026-118513 is an authentication bypass by spoofing vulnerability in Symfony's X509Authenticator and X509AuthenticationListener components, representing an incomplete fix for the prior CVE-2026-45063. It affects symfony/security-http versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The vulnerability was disclosed on November 4, 2026, with patches released the same day. It carries a CVSS v4.0 base score of 7.7 (High) (Symfony Advisory, GitHub Advisory).

The root cause is CWE-290 (Authentication Bypass by Spoofing), stemming from a regular expression used to extract user identifiers from the X.509 Subject Distinguished Name (DN) that is not escape-aware. The fix for CVE-2026-45063 anchored extraction to RDN boundaries using (?:^|[,/]), but this regex runs against the already-serialized DN string and cannot distinguish a true RDN separator from an escaped separator character embedded inside a value. Under RFC 2253 (used by Apache and nginx's $ssl_client_s_dn), a comma inside a value is escaped as \,, but the regex treats it as a separator; similarly, bare slashes inside RFC 2253 values are misread as separators. The legacy X509_NAME_oneline() format (used by Apache's LegacyDNStringFormat and nginx's $ssl_client_s_dn_legacy) has the mirror problem: escaped slashes (\/) are misread, and bare commas inside values are treated as separators. Quoted values (as produced by OpenSSL's XN_FLAG_ONELINE) are also affected. The fix replaces the regex-on-serialized-string approach with proper DN splitting into RDNs before attribute lookup (GitHub Advisory, Patch Commit).

An attacker holding a certificate issued by the application's trusted CA who can influence the CN field of that certificate can authenticate as an arbitrary user of the application, including privileged administrators. This results in full confidentiality, integrity, and availability impact on the vulnerable system, enabling unauthorized access to sensitive data, unauthorized modification of application data, and potential disruption of service. Applications that pass a per-attribute userKey (e.g., Apache's SSL_CLIENT_S_DN_Email) are not affected, nor are deployments where the CA generates or validates the subject itself rather than accepting requester-supplied values (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). Exploitation requires the attacker to already hold a certificate from the application's trusted CA and to be able to influence the CN field of that certificate — a non-trivial precondition that limits the attack surface. No threat actor attribution or CISA KEV catalog listing has been reported. The CVSS v4.0 Attack Requirements metric is rated "Present," reflecting these prerequisite conditions (GitHub Advisory).

1. Obtain a trusted CA certificate: Acquire a certificate issued by the same CA trusted by the target Symfony application, with the ability to influence the CN field value (e.g., through a CA that accepts requester-supplied subject values).
2. Craft a malicious CN value: Set the certificate's CN to a value that embeds a fake emailAddress attribute using the appropriate escape syntax for the target web server's DN format. For RFC 2253 (Apache/nginx default), use an escaped comma: CN=jdoe\,emailAddress=admin@target.example. For legacy format, use a bare comma: CN=jdoe,emailAddress=admin@target.example (in a slash-separated DN).
3. Trigger DN serialization: When the web server (Apache or nginx) passes the client certificate's Subject DN to Symfony via $_SERVER['SSL_CLIENT_S_DN'], the serialized string will contain the crafted value.
4. Exploit the regex: The vulnerable regex in X509Authenticator or X509AuthenticationListener misinterprets the escaped comma (or bare slash) as an RDN boundary, extracting admin@target.example as the user identifier instead of the legitimate value.
5. Authenticate as target user: Symfony authenticates the attacker as the spoofed user (e.g., admin@target.example), granting them that user's privileges within the application (GitHub Advisory, Patch Commit).

• Logs: Authentication log entries showing a user identifier (e.g., an email address) that does not match the certificate's genuine emailAddress attribute; successful logins from accounts that do not correspond to the presented certificate's legitimate owner.
• Network: TLS client certificate authentication requests where the SSL_CLIENT_S_DN server variable contains escaped commas (\,), bare slashes in RFC 2253 values, or quoted CN values embedding emailAddress= or OID 1.2.840.113549.1.9.1= patterns.
• Application: Privileged actions performed by accounts that have no prior activity history, or session activity inconsistent with the certificate holder's expected behavior; audit logs showing admin-level access from certificates not belonging to admin users (GitHub Advisory).

Upgrade symfony/security-http (or symfony/symfony) to one of the patched versions: 5.4.56, 6.4.50, 7.4.23, or 8.1.11, depending on the currently deployed branch. As a configuration-based mitigation, switch to passing a per-attribute user key (e.g., Apache's SSL_CLIENT_S_DN_Email or nginx's ssl_c_s_dn(emailAddress)) rather than relying on the full DN fallback, as this code path is not affected. Deployments using Apache's LegacyDNStringFormat, nginx's $ssl_client_s_dn_legacy, or HAProxy's ssl_c_s_dn with OpenSSL < 3.0 should migrate to RFC 2253 DN output ($ssl_client_s_dn, Apache's default, or ssl_c_s_dn(,rfc2253)) (Symfony Advisory, GitHub Advisory).

The vulnerability was credited to reporters Oryam Halachmi, dahmani toumi, and Stapat, with Bruno Dias and João Oliveira from Checkmarx acknowledged for assistance in CVE assignment. The fix was authored by Symfony core contributor nicolas-grekas and published by fabpot on November 4, 2026 (GitHub Advisory).