Threats affecting pkg:composer/symfony/http-client

A vulnerability in the ScopingHttpClient component of Symfony HttpClient allows exposure of sensitive authentication credentials to attacker-controlled servers. This occurs when a network-path reference URL (e.g., "//evil.example/steal") is resolved against a base URI with default scoped credentials, causing those credentials to be sent to an unintended origin. The issue affects Symfony versions prior to 5.4.56, 6.4.50, 7.4.23, and 8.1.11. The flaw is fixed by verifying that the resolved URL's scheme and authority match the base URI before sending credentials.