# CVE-2026-121971: Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

Status: published. Published: 2026-11-04. Updated: 2026-11-04.

The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such as "//evil.example/steal" to be sent to another origin together with the default scope’s credentials, and resulting in potential disclosure of those credentials to an attacker-controlled server. This affects Symfony in versions 5.x prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.



The resolved URL falls outside the origin of the base URI, yet it keeps the merged options, whereas the absolute spelling "https://evil.example/steal" receives none. The same happens with a different port or user-info part on the same host.









This is reachable whenever an attacker controls the beginning of a URL passed to a client built with a base_uri and credentials, including those created with HttpClient::createForBaseUri() or configured under framework.http_client.scoped_clients.

To solve the issue, after resolving a relative URL against the base URI of the default scope, ScopingHttpClient now compares the scheme and authority of the result with those of the base URI, parsed the way the request is sent.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: Checkmarx) — https://github.com/symfony/symfony/commit/64c34e85bd03b3f8a735d8e1af393659dda91d7c

## Affected products and versions

- sensiolabs / symfony (symfony/http-client): ≥ 0; < 5.4.56 (affected, git); ≥ 6.0.0; < 6.4.50 (affected, git); ≥ 7.0.0; < 7.4.23 (affected, git); ≥ 8.0.0; < 8.1.11 (affected, git). Source: CNA: Checkmarx

## Severity and prioritization

- CVSS 4.0: 8.2 (high); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N; source: CNA: Checkmarx

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-200, CWE-522

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-gq53-v8w2-gjhj (CNA: Checkmarx; third-party-advisory)

- https://github.com/symfony/symfony/commit/64c34e85bd03b3f8a735d8e1af393659dda91d7c (CNA: Checkmarx; patch)

## Provenance

- CNA: Checkmarx: https://www.cve.org/CVERecord?id=CVE-2026-121971; retrieved 2026-11-04; source updated 2026-11-04

Revision: 27a38a5eef710ad75ee7ecd90a19ffd423a724047ab6ed5e2cfa36e8f23368dc

Canonical: https://y2.dev/cve/CVE-2026-121971

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.