**Symfony version(s) affected**: 3.4.32 **Description** When you throw a AccessDeniedException in a controller and no firewall is defined, a 500 error code is given instead of the expected 403. **How to reproduce** - make a new project (`symfony new app`) - in a new controller/action, write `throw new AccessDeniedException();` or `throw $this->createAccessDeniedException();` - call page - a 500 error is raised. **Expected** A 403 error should be raised. **Notes** I know there are similar issues but they all are closed without having been fixed - for what I've seen. (#15236 #11663 #19906 #8467 #20233)