CVE-2026-61614: Symfony Header Query Param Fallbackcve-2026-61614-symfony-header-query-param-fallback
Sensitive request headers such as authentication tokens should not fall back to URL query parameters ($request->query->get()). Passing credentials in query strings exposes them in server access logs, proxy logs, browser history, and HTTP Referer headers.
