CVE-2026-45063: Identity Spoofing via Unanchored DN Regex in X509Authenticator

PKSA-tbsf-h7vc-j7hn CVE-2026-45063

Affected version: >=2.0.0,<3.0.0|>=3.0.0,<4.0.0|>=4.0.0,<5.0.0|>=5.0.0,<5.1.0|>=5.1.0,<5.2.0|>=5.2.0,<5.3.0|>=5.3.0,<5.4.0|>=5.4.0,<5.4.52|>=6.0.0,<6.1.0|>=6.1.0,<6.2.0|>=6.2.0,<6.3.0|>=6.3.0,<6.4.0|>=6.4.0,<6.4.40|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.4.12|>=8.0.0,<8.0.12

Reported by:
FriendsOfPHP/security-advisories

[HIGH] CVE-2019-10911: Add a separator in the remember me cookie hash

PKSA-q3pf-cxf3-f7xy CVE-2019-10911 GHSA-cchx-mfrc-fwqr

Affected version: >=2.7.0,<2.7.51|>=2.8.0,<2.8.50|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.4.0|>=3.4.0,<3.4.26|>=4.0.0,<4.1.0|>=4.1.0,<4.1.12|>=4.2.0,<4.2.7

Reported by:
GitHub, FriendsOfPHP/security-advisories

[HIGH] CVE-2018-11406: CSRF Token Fixation

PKSA-4cs6-1fmm-cwn2 CVE-2018-11406 GHSA-g4g7-q726-v5hg

Affected version: >=2.4.0,<2.7.48|>=2.5.0,<2.7.48|>=2.6.0,<2.7.48|>=2.7.0,<2.7.48|>=2.8.0,<2.8.41|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.17|>=3.4.0,<3.4.11|>=4.0.0,<4.0.11

Reported by:
GitHub, FriendsOfPHP/security-advisories

[HIGH] CVE-2018-11385: Session Fixation Issue for Guard Authentication

PKSA-r1pj-t5t2-c1n6 CVE-2018-11385 GHSA-g4rg-rw65-8hfg

Affected version: >=2.4.0,<2.7.48|>=2.5.0,<2.7.48|>=2.6.0,<2.7.48|>=2.7.0,<2.7.48|>=2.8.0,<2.8.41|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.3.0|>=3.3.0,<3.3.17|>=3.4.0,<3.4.11|>=4.0.0,<4.0.11

Reported by:
GitHub, FriendsOfPHP/security-advisories

[MEDIUM] CVE-2017-16652: Open redirect vulnerability on security handlers

PKSA-bmrb-mr4g-zmyn CVE-2017-16652 GHSA-r7p7-qr7p-2rrf

Affected version: >=2.7.0,<2.7.38|>=2.8.0,<2.8.31|>=3.0.0,<3.1.0|>=3.1.0,<3.2.0|>=3.2.0,<3.2.14|>=3.3.0,<3.3.13

Reported by:
GitHub, FriendsOfPHP/security-advisories