CVE-2023-46733

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5.4.31 and 6.3.8, `SessionStrategyListener` does not migrate the session after every successful login. It does so only in case the logged in user changes by means of checking the user identifier. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations, which is not the case at the moment. As of versions 5.4.31 and 6.3.8, Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated.

• CWE-384

• https://github.com/symfony/symfony/commit/7467bd7e3f888b333102bc664b5e02ef1e7f88b9Patch
• https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74Patch
• https://github.com/symfony/symfony/security/advisories/GHSA-m2wj-r6g3-fxfxPatch, Vendor Advisory
• https://github.com/symfony/symfony/commit/7467bd7e3f888b333102bc664b5e02ef1e7f88b9Patch
• https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74Patch
• https://github.com/symfony/symfony/security/advisories/GHSA-m2wj-r6g3-fxfxPatch, Vendor Advisory

Published

Nov 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-46728Squid is a caching proxy for the Web supporting HTTP, HTTPS,…7.5
• CVE-2023-46729sentry-javascript provides Sentry SDKs for JavaScript. An un…6.1
• CVE-2023-4673Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2023-46730Group-Office is an enterprise CRM and groupware tool. In aff…8.8
• CVE-2023-46731XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2023-46732XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2023-46734Symfony is a PHP framework for web and console applications …6.1
• CVE-2023-46735Symfony is a PHP framework for web and console applications …6.1
• CVE-2023-46736EspoCRM is an Open Source CRM (Customer Relationship Managem…6.5
• CVE-2023-46737Cosign is a sigstore signing tool for OCI containers. Cosign…5.3
• CVE-2023-46738CubeFS is an open-source cloud-native file storage system. A…6.5
• CVE-2023-46739CubeFS is an open-source cloud-native file storage system. A…5.9