CVE-2016-2403 — Vulnerability in symfony/security-core — CVE Details
Symfony Authentication Bypass
Summary
Advisory Timeline
- First published May 14, 2022 (1612 days ago).
- Last revised February 16, 2024 — 643 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
composer require "symfony/security-core:^3.0.6"
composer require "symfony/symfony:^2.8.6"
composer require "symfony/symfony:^3.0.6"
composer require "symfony/security-core:^2.8.6"
composer require "symfony/security:^2.8.6"
composer require "symfony/security:^3.0.6"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (6)
Affects 1 ecosystem: packagist (3).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| symfony/security-core | packagist | v3.0.0, v3.0.1, v3.0.2, v3.0.3 (+2 more) | 3.0.6 |
| symfony/symfony | packagist | v2.8.0, v2.8.1, v2.8.2, v2.8.3 (+2 more) | 2.8.6 |
| symfony/symfony | packagist | v3.0.0, v3.0.1, v3.0.2, v3.0.3 (+2 more) | 3.0.6 |
| symfony/security-core | packagist | v2.8.0, v2.8.1, v2.8.2, v2.8.3 (+2 more) | 2.8.6 |
| symfony/security | packagist | v2.8.0, v2.8.1, v2.8.2, v2.8.3 (+2 more) | 2.8.6 |
| symfony/security | packagist | v3.0.0, v3.0.1, v3.0.2, v3.0.3 (+2 more) | 3.0.6 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-287Improper AuthenticationMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-2403ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-core/CVE-2016-2403.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2016-2403.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2016-2403.yamlWEB
- https://symfony.com/cve-2016-2403WEB
- https://web.archive.org/web/20210123224944/http://www.securityfocus.com/bid/96137WEB
- https://www.debian.org/security/2018/dsa-4262WEB
- https://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-passwordWEB
Frequently Asked Questions
- What is CVE-2016-2403?
- Symfony Authentication Bypass This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2016-2403?
- CVE-2016-2403 affects symfony/security-core, symfony/symfony and symfony/security. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2016-2403 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2018-11407CRITICAL
Symfony Authentication Bypass
- CVE-2019-10910CRITICAL
Symfony Service IDs Allow Injection
- CVE-2017-11365CRITICAL
Symfony Incorrect Access Control
- CVE-2018-11406HIGH
Symfony CSRF Token Fixation
- CVE-2026-45077HIGH
Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
- CVE-2026-45063HIGH
Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
- CVE-2024-51736HIGH
Symfony vulnerable to command execution hijack on Windows with Process class
- CVE-2026-48784MEDIUM
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies