Cloudanix VulnDB

CVE-2026-45063

High · 7.5

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

CVSS

7.5

EPSS

0.4%

Published

May 27, 2026

CISA due date

—

The record

`X509Authenticator` implements client-certificate (mTLS) authentication: the web server validates the client's certificate against a trusted CA, then passes the certificate's Subject DN (Distinguished Name: a string like `CN=Alice,O=Example,emailAddress=alice@example.com`) to Symfony via `$_SERVER['SSL_CLIENT_S_DN']`. Symfony extracts the user identifier from that string. The extraction uses an **unanchored** regex that matches `emailAddress=` anywhere in the DN string: including inside the *value* of a different RDN (Relative Distinguished Name: one `key=value` component of the DN), such as `CN`. An attacker who can obtain a certificate from a trusted CA with a free-text `CN` can smuggle `emailAddress=victim@target` inside the CN value and be authenticated as the victim.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities