CVE-2019-10911

score

<0.1

cvss

7.5

epss

1.2%

published

2019-05-16

kev added

—

first seen

2026-10-21

Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7 contain a broken authentication vulnerability caused by flawed remember me login implementation in symfony/security, letting attackers authenticate as privileged users on sites with user registration and remember me enabled, exploit requires no special conditions.