CVE-2021-41268

Symfony/SecurityBundle is the security system for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Since the rework of the Remember me cookie in version 5.3.0, the cookie is not invalidated when the user changes their password. Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie. Starting with version 5.3.12, Symfony makes the password part of the signature by default. In that way, when the password changes, then the cookie is not valid anymore.

• CWE-384

• https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfcPatch, Third Party Advisory
• https://github.com/symfony/symfony/pull/44243Patch, Third Party Advisory
• https://github.com/symfony/symfony/releases/tag/v5.3.12Release Notes, Third Party Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-qw36-p97w-vcqrPatch, Third Party Advisory
• https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfcPatch, Third Party Advisory
• https://github.com/symfony/symfony/pull/44243Patch, Third Party Advisory
• https://github.com/symfony/symfony/releases/tag/v5.3.12Release Notes, Third Party Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-qw36-p97w-vcqrPatch, Third Party Advisory

Published

Nov 24, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41262Galette is a membership management web application built for…8.8
• CVE-2021-41263rails_multisite provides multi-db support for Rails applicat…8.8
• CVE-2021-41264OpenZeppelin Contracts is a library for smart contract devel…9.8
• CVE-2021-41265Flask-AppBuilder is a development framework built on top of …8.8
• CVE-2021-41266Minio console is a graphical user interface for the for MinI…9.8
• CVE-2021-41267Symfony/Http-Kernel is the HTTP kernel component for Symfony…6.5
• CVE-2021-41269cron-utils is a Java library to define, parse, validate, mig…9.8
• CVE-2021-4127An out of date graphics library (Angle) likely contained vul…9.8
• CVE-2021-41270Symfony/Serializer handles serializing and deserializing dat…6.5
• CVE-2021-41271Discourse is a platform for community discussion. In affecte…5.3
• CVE-2021-41272Besu is an Ethereum client written in Java. Starting in vers…7.5
• CVE-2021-41273Pterodactyl is an open-source game server management panel b…4.3