[GHSA-8wx3-8m4x-g5h4] FOSUserBundle User Identity Validation Vulnerability

[RainSignal]

Updates

• Affected products

Comments
The advisory states the affected versions start from 1.2.0, but code
review shows the vulnerable code exists as far back as 1.0.0, which
is the earliest version available on Packagist.

The vulnerable refreshUser() method in Model/UserManager.php at 1.0.0:
https://github.com/FriendsOfSymfony/FOSUserBundle/blob/1.0.0/Model/UserManager.php

uses loadUserByUsername($user->getUsername()) to reload the user on
each request, instead of loading by primary key. This means the
affected version range should start from 1.0.0, not 1.2.0.

Additionally, the current severity is listed as Moderate, but the
vulnerability allows an authenticated user to impersonate another
user by changing their username to match an existing account,
resulting in full account takeover. This warrants a High severity
rating with CVSS vector:
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (score: 7.5)

AC:H reflects that exploitation requires the application to be
configured to allow username changes, which is not the default
behavior but is a supported feature of the bundle.

The weakness CWE-285 (Improper Authorization) should also be
replaced with CWE-287 (Improper Authentication), as the root cause
is the authentication refresh mechanism using an incorrect identifier,
not an authorization check failure.