-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/security-bundle | composer | >= 6.2.0, < 6.4.10 | 6.4.10 |
| symfony/security-bundle | composer | >= 7.0.0, < 7.0.10 | 7.0.10 |
| symfony/security-bundle | composer | >= 7.1.0, < 7.1.3 | 7.1.3 |
| symfony/symfony | composer | >= 6.2.0, < 6.4.10 | 6.4.10 |
| symfony/symfony | composer | >= 7.0.0, < 7.0.10 | 7.0.10 |
| symfony/symfony | composer | >= 7.1.0, < 7.1.3 | 7.1.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Security::login() method not utilizing firewall-specific user checkers. The commit diff shows the fix changed the user checker retrieval from direct 'security.user_checker' service to a locator pattern ('security.user_checker_locator') that selects the checker based on firewall context. The pre-patch version in Security.php line 130 directly called the global user checker, ignoring per-firewall configurations. This matches the vulnerability description about custom user_checkers being ignored during programmatic login.
A Semantic Attack on Google Gemini - Read the Latest Research