CVE-2022-23601

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks. This issue has been resolved in the patch versions listed and users are advised to update. There are no known workarounds for this issue.

• CWE-352

• https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50Patch, Third Party Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-vvmr-8829-6whxPatch, Third Party Advisory
• https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50Patch, Third Party Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-vvmr-8829-6whxPatch, Third Party Advisory

Published

Feb 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23595Tensorflow is an Open Source Machine Learning Framework. Whe…6.5
• CVE-2022-23596Junrar is an open source java RAR archive library. In affect…7.5
• CVE-2022-23597Element Desktop is a Matrix client for desktop platforms wit…8.8
• CVE-2022-23598laminas-form is a package for validating and displaying simp…6.1
• CVE-2022-23599Products.ATContentTypes are the core content types for Plone…6.1
• CVE-2022-23600fleet is an open source device management, built on osquery.…6.5
• CVE-2022-23602Nimforum is a lightweight alternative to Discourse written i…8.1
• CVE-2022-23603iTunesRPC-Remastered is a discord rich presence application …6.1
• CVE-2022-23604x26-Cogs is a repository of cogs made by Twentysix for the R…7.2
• CVE-2022-23605Wire webapp is a web client for the wire messaging protocol.…2.3
• CVE-2022-23606Envoy is an open source edge and service proxy, designed for…6.5
• CVE-2022-23607treq is an HTTP library inspired by requests but written on …6.5