Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay (CVE-2026-45074) | HOL Guard CVE