CVE-2021-41268

    Dashboard / Vulnerabilities / CVE-2021-41268

    CVE-2021-41268

    Published: 24 Nov 2021Last Modified: 7 Aug 2026

    Summary:

    Details: Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie. Starting with version 5.3.12, Symfony makes the password part of the signature by default. In that way, when the password changes, then the cookie is not valid anymore.

    References: https://github.com/symfony/symfony/releases/tag/v5.3.12, https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfc, https://github.com/symfony/symfony/pull/44243, https://github.com/symfony/symfony/security/advisories/GHSA-qw36-p97w-vcqr

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- bc3abacc8bed6ca1e6924bed48580b85eccf4e82
    Fixed -256c34a45b79fdc6276a8c941a1656713ee1ffec

    Affected versions

    v5.3.11
    v5.3.10
    v5.3.9
    v5.3.8
    v5.3.7
    v5.3.6
    v5.3.5
    v5.3.4
    v5.3.3
    v5.3.2
    v5.3.1
    v5.3.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41268 | CVE-DB