lexik/jwt-authentication-bundle
JWT authentication for your Symfony API
Activity
- Latest release
- Dec 20, 2025
- Total releases
- 93
- Cadence
- ~19 days
- Last 12 months
- 1
Reach
- Stars
- 2.6k
Details
- License
- MIT
- First release
- May 16, 2014
| Version | Released | |
|---|---|---|
v3.2.0
minor
|
v3.2.0
minor
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
v3.1.1
patch
|
v3.1.1
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
v3.1.0
minor
| ||
v3.0.0
major
| ||
v2.21.0
minor
|
v2.21.0
minor
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
v2.20.3
patch
|
v2.20.3
patch
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
v2.20.2
patch
| ||
v2.20.1
patch
| ||
v2.20.0
minor
| ||
v2.19.1
patch
|
v2.19.1
patch
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
v2.19.0
minor
| ||
v2.18.1
patch
|
v2.18.1
patch
Dependencies (11)
+ 3 more
Changelog
Compare changes
|
|
v2.18.0
minor
| ||
v2.17.0
minor
| ||
v2.16.0
minor
|
v2.16.0
minor
Dependencies (13)
+ 5 more
Changelog
Compare changes
|
|
v2.15.1
patch
| ||
v2.15.0
minor
| ||
v2.14.4
patch
|
v2.14.4
patch
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
v2.14.3
patch
| ||
v2.14.2
patch
| ||
v2.14.1
patch
|
v2.14.1
patch
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
v2.14.0
minor
|
v2.14.0
minor
Dependencies (12)
+ 4 more
Changelog
Compare changes
|
|
v2.13.0
minor
| ||
v2.12.6
patch
| ||
v2.12.5
patch
| ||
v2.12.4
patch
| ||
v2.12.3
patch
| ||
v2.12.2
patch
| ||
v2.12.1
patch
| ||
v2.12.0
minor
| ||
v2.11.3
patch
| ||
v2.10.7
patch
| ||
v2.11.2
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.11.1
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.11.0
minor
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.10.6
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.10.5
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.10.4
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.10.3
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.10.2
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.10.1
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.10.0
minor
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.9.0
minor
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.8.0
minor
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.7.0
minor
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.6.5
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.6.4
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.6.3
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.6.2
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev | ||
v2.6.1
patch
2 CVEs
GHSA-2frx-j9hj-6c65
May 17, 2021
User enumeration in authentication mechanisms
Low
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. ResolutionWe now ensure that a generic message is returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 2.10.x and 2.x. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
1.6.0
v1.0.0
v1.0.1
v1.0.10
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
+ 49 more Show less
v1.1.0
v1.2.0
v1.3.0
v1.3.1
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.7.0
v1.7.1
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References Updated Dec 02, 2024 · Source: OSV.dev
CVE-2021-21424
GHSA-5pv8-ppvj-4h68
BIT-symfony-2021-21424
May 13, 2021
Prevent user enumeration using Guard or the new Authenticator-based Security
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
Low
None
None
DescriptionThe ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user. ResolutionWe now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist. The patch for this issue is available here for branch 3.4. CreditsI would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Chalas for fixing the issue. Affected versions
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.10.5
+ 25 more Show less
v2.10.6
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.7.0
v2.8.0
v2.9.0
v2.11.0
v2.11.1
v2.11.2
Fixed in
2.10.7
2.11.3
References
Updated Mar 13, 2026 · Source: OSV.dev |