# CVE-2026-121971

Symfony HttpClient bug leaks default-scope credentials to attacker-controlled origins.

- Page: https://www.vulneraibility.com/cve/CVE-2026-121971
- CVSS: 8.2
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.25% (percentile 16.3)
- CISA SSVC: exploitation none, automatable no, technical impact partial (assessed 2026-11-04)
- Weakness: CWE-200, CWE-522
- Also known as: GHSA-gq53-v8w2-gjhj
- Published: 2026-11-04

## Affected versions

- sensiolabs symfony: affected < 5.4.56; >= 6.0.0 and < 6.4.50; >= 7.0.0 and < 7.4.23; >= 8.0.0 and < 8.1.11

A version outside these ranges is not a statement that it is unaffected.

## Impact

Credential disclosure: auth_bearer/auth_basic merged into requests resolved to network-path refs (//host) can send creds to attacker-controlled origins.

## Action

Immediate action required

## Recommendation

Upgrade to fixed Symfony versions, rotate any potentially exposed credentials, and avoid untrusted relative URLs.

## References

- [advisory] https://github.com/symfony/symfony/security/advisories/GHSA-gq53-v8w2-gjhj
- [patch] https://github.com/symfony/symfony/commit/64c34e85bd03b3f8a735d8e1af393659dda91d7c

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.