CVE-2026-45063: Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

X509Authenticator implements client-certificate (mTLS) authentication: the web server validates the client’s certificate against a trusted CA, then passes the certificate’s Subject DN (Distinguished Name: a string like CN=Alice,O=Example,emailAddress=alice@example.com) to Symfony via $_SERVER['SSL_CLIENT_S_DN']. Symfony extracts the user identifier from that string.

The extraction uses an unanchored regex that matches emailAddress= anywhere in the DN string: including inside the value of a different RDN (Relative Distinguished Name: one key=value component of the DN), such as CN. An attacker who can obtain a certificate from a trusted CA with a free-text CN can smuggle emailAddress=victim@target inside the CN value and be authenticated as the victim.