Symfony OidcTokenHandler Missing Mandatory Claims Verification

Technical Analysis

The vulnerability resides in ClaimCheckerManager::check() usage within OidcTokenHandler::verifyClaims(), where the mandatory claims list (aud, iss, exp) is registered as checkers but never actually passed as required to the check() call, causing the manager to silently skip enforcement of missing claims. An attacker possessing any validly signed JWT—even one lacking audience, issuer, or expiry fields, or issued for a different application—could have that token accepted by the OIDC token handler, resulting in authentication bypass or privilege escalation depending on how the application maps claims to identity. This is particularly severe in multi-tenant or federated identity setups where token scoping across audiences/issuers is security-critical. Exploitation requires no special access beyond obtaining a validly signed JWT from any trusted (or loosely trusted) issuer accepted by the relying party's key configuration. AI agent systems using Symfony-based backends for OIDC-secured API gateways, agent orchestration dashboards, or RAG pipeline access control are directly impacted, as this flaw could allow forged or cross-tenant tokens to gain unauthorized access to agent management APIs, tool-invocation endpoints, or stored credentials/API keys.

Affected Systems

Symfony framework and Security component versions prior to 6.4.40, 7.4.12, and 8.0.12; specifically applications using OidcTokenHandler for OIDC-based JWT authentication/authorization.

Indicators of Compromise

• No specific IOCs published; detection requires code/config review of Symfony Security component version and OidcTokenHandler usage

Remediation Steps

1. 1

   Upgrade Symfony

   Immediately update Symfony to version 6.4.40, 7.4.12, 8.0.12, or later to ensure ClaimCheckerManager::check() properly enforces mandatory aud, iss, and exp claims.

2. 2

   Audit OIDC token usage

   Review all applications and services using OidcTokenHandler to confirm they are not accepting tokens with missing or unexpected audience/issuer/expiry claims.

3. 3

   Review authentication logs

   Inspect authentication logs for anomalous JWTs, particularly tokens lacking standard claims or originating from unexpected issuers, that were accepted prior to patching.

4. 4

   Restrict trusted issuers

   Where possible, tighten issuer and audience allow-lists at the identity provider or gateway level as defense-in-depth, independent of the Symfony-level fix.

5. 5

   Rotate exposed credentials

   If agent systems or API gateways relied on the vulnerable OIDC flow, rotate any API keys, service tokens, or session credentials that may have been exposed to unauthorized access.