CVE-2018-11406

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

• CWE-352

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/
• https://symfony.com/blog/cve-2018-11406-csrf-token-fixationVendor Advisory
• https://www.debian.org/security/2018/dsa-4262Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH/
• https://symfony.com/blog/cve-2018-11406-csrf-token-fixationVendor Advisory
• https://www.debian.org/security/2018/dsa-4262Third Party Advisory

Published

Jun 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11400In SimpliSafe Original, the Base Station fails to detect tam…
• CVE-2018-11401In SimpliSafe Original, RF Interference (e.g., an extremely …
• CVE-2018-11402SimpliSafe Original has Unencrypted Keypad Transmissions, wh…
• CVE-2018-11403DomainMod v4.09.03 has XSS via the assets/edit/account-owner…
• CVE-2018-11404DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-…
• CVE-2018-11405Kliqqi 2.0.2 has CSRF in admin/admin_users.php.
• CVE-2018-11407An issue was discovered in the Ldap component in Symfony 2.8…
• CVE-2018-11408The security handlers in the Security component in Symfony i…
• CVE-2018-11409Splunk through 7.0.1 allows information disclosure by append…
• CVE-2018-1141When installing Nessus to a directory outside of the default…
• CVE-2018-11410An issue was discovered in Liblouis 3.5.0. A invalid free in…
• CVE-2018-11411The transferFrom function of a smart contract implementation…