Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when framework.trusted_hosts is not configured; an attacker controlling another application registered with the same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim. This issue is fixed in versions 7.4.12 and 8.0.12.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From
    7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from
    Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when
    framework.trusted_hosts is not configured; an attacker controlling another application registered with the
    same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim.
    This issue is fixed in versions 7.4.12 and 8.0.12. (CVE-2026-45074)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From     7.1.0 until 7.4.12 and 8.0.12, Cas2Handler builds the CAS service parameter from     Request::getSchemeAndHttpHost(), which reflects an attacker-controlled Host header when     framework.trusted_hosts is not configured; an attacker controlling another application registered with the     same CAS server can replay a victim ticket against the Symfony application and authenticate as the victim.
    This issue is fixed in versions 7.4.12 and 8.0.12. (CVE-2026-45074)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
442413	SCA: security update for symfony/security-http, symfony/symfony (GHSA-j8gj-9rm5-4xhx)	Tenable Cloud Security	SCA Checks	Local	high
442413	SCA: security update for symfony/security-http, symfony/symfony (GHSA-j8gj-9rm5-4xhx)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
316507	Linux Distros Unpatched Vulnerability : CVE-2026-45074	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-45074

high

Tenable Plugins

high

high

high