Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

symfony/security-core

              8.2 @ 2350e2f
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Insecure Deserialization: Legacy implementations of the PHP Serializable interface and nested unserialize calls in AbstractToken allowed untrusted object injection. This could lead to PHP gadget chain execution, posing a severe threat to applications relying on session-restored tokens.

Remote Code Execution: The processing of serialized security components allowed attackers to trigger object injection and execute arbitrary code. The mitigation required strict class-type validation inside __unserialize methods to reject dangerous objects, such as \Stringable wrappers.

Auth Bypass: Flaws in token serialization logic (__serialize) either leaked expired/stale user roles (when the user implemented EquatableInterface) or omitted authorization roles entirely. This caused inconsistent session security states and authorization bypasses on subsequent requests.