https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T04:17:55.805633+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-0948 certfr-2024-avi-0948 — De multiples vulnérabilités ont été découvertes dans les produits Symfony. Certaines d'entre elles permettent à un atta… 2026-10-06T04:17:55.810815+00:00 certfr-2024-avi-0948 https://cve.radiocsirt.org/vuln/euvd-2026-199900 EUVD-2026-199900 2026-10-06T04:17:55.810849+00:00 EUVD-2026-199900 https://cve.radiocsirt.org/vuln/fkie_cve-2024-50341 fkie_cve-2024-50341 2026-10-06T04:17:55.810863+00:00

symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-jxgr-3v7q-3w9v GHSA-jxgr-3v7q-3w9v — Symfony's `Security::login` does not take into account custom `user_checker` 2026-10-06T04:17:55.810892+00:00

Affected: Packagist: symfony/security-bundle, Packagist: symfony/symfony

### Description

The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login.

### Resolution

The `Security::login` method now ensure to call the configured `user_checker`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/22a0789a0085c3ee96f4ef715ecad8255cf0e105) for branch 6.4.

### Credits

We would like to thank Oleg Andreyev, Antoine MAKDESSI for reporting the issue and Christian Flothmann for providing the fix.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-50341 UBUNTU-CVE-2024-50341 2026-10-06T04:17:55.810924+00:00

Affected: Ubuntu:Pro:24.04:LTS: symfony

symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.