CVE-2016-2403

—

CVSS 3.0

9.8 critical

EPSS

3%p86

Published

Feb 7, 2017 (Feb 7, 2017)

Modified

Jun 17, 2026

Description

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

Vendors: sensiolabs
Products: symfony
Weakness: CWE-287
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.9%)

In the news0 stories

No ingested article mentions this CVE yet.