Search: CVE-2026-45063

A vulnerability in the Symfony PHP framework's X509Authenticator component allows an attacker with a trusted certificate containing a crafted emailAddress attribute in the distinguished name to authenticate as another user. This occurs due to an unanchored regular expression matching emailAddress anywhere in the DN, enabling impersonation. The issue affects multiple Symfony versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. Fixed versions have been released to address this authentication bypass.