High severity7.5OSV Advisory· Published Nov 13, 2024· Updated Apr 15, 2026
CVE-2024-51996
CVE-2024-51996
Description
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
symfony/security-httpPackagist | >= 5.3.0, < 5.4.47 | 5.4.47 |
symfony/security-httpPackagist | >= 6.0.0-BETA1, < 6.4.15 | 6.4.15 |
symfony/security-httpPackagist | >= 7.0.0-BETA1, < 7.1.8 | 7.1.8 |
Affected products
2- Range: v6.0.0-BETA1, v6.0.0-BETA2, v6.0.0-BETA3, …
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-cg23-qf8f-62rrghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-51996ghsaADVISORY
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2024-51996.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-51996.yamlghsaWEB
- github.com/symfony/symfony/commit/81354d392c5f0b7a52bcbd729d6f82501e94135anvdWEB
- github.com/symfony/symfony/security/advisories/GHSA-cg23-qf8f-62rrnvdWEB
- symfony.com/cve-2024-51996ghsaWEB
News mentions
0No linked articles in our index yet.