CVE-2026-31819: Sylius eCommerce Framework CSRF Vulnerability

CVE-2026-31819 Overview

CVE-2026-31819 is an Open Redirect vulnerability affecting Sylius, an Open Source eCommerce Framework built on Symfony. The vulnerability exists in multiple controllers where the HTTP Referer header is used directly when performing redirects without proper validation. Specifically, the affected components include CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction(), and StorageBasedLocaleSwitcher::handle().

Critical Impact

This vulnerability enables phishing and credential theft attacks by allowing attackers to redirect users from trusted Sylius domains to malicious sites. Public endpoints can be exploited without authentication, while admin-only endpoints remain vulnerable if administrators follow external links.

Affected Products

• Sylius versions prior to 1.9.12
• Sylius versions 1.10.x prior to 1.10.16
• Sylius versions 1.11.x prior to 1.11.17
• Sylius versions 1.12.x prior to 1.12.23
• Sylius versions 1.13.x prior to 1.13.15
• Sylius versions 1.14.x prior to 1.14.18
• Sylius versions 2.0.x prior to 2.0.16
• Sylius versions 2.1.x prior to 2.1.12
• Sylius versions 2.2.x prior to 2.2.3

Discovery Timeline

• 2026-03-10 - CVE-2026-31819 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-31819

Vulnerability Analysis

This Open Redirect vulnerability (CWE-601) occurs when the Sylius application blindly trusts the HTTP Referer header to determine where to redirect users after performing certain actions. The attack requires minimal user interaction—the victim only needs to click on a legitimate application link that has been placed on an attacker-controlled page.

When a user clicks a link to a vulnerable Sylius endpoint from an attacker's website, the browser automatically includes the attacker's URL in the Referer header. The Sylius application then uses this untrusted value to redirect the user back, effectively sending them to the malicious site. Since the redirect originates from the trusted Sylius domain, users are more likely to trust the destination, making this an effective vector for phishing attacks.

The severity varies based on the affected endpoint. Public-facing endpoints such as the currency switcher require no authentication and are trivially exploitable by any attacker. Admin-only endpoints like the user impersonation controller require the victim to have an authenticated administrative session, but remain vulnerable if an administrator follows an external link from email, chat applications, or other external sources.

Root Cause

The root cause of this vulnerability is improper input validation of the HTTP Referer header. The affected controller methods (CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction(), and StorageBasedLocaleSwitcher::handle()) extract the Referer value and use it directly as the redirect target without validating that the URL belongs to an allowed domain or follows a safe pattern. This violates the security principle of never trusting user-controllable input, as the Referer header can be influenced by attackers through careful placement of links on external sites.

Attack Vector

The attack is network-based and requires user interaction. An attacker creates a malicious webpage containing a link to a vulnerable Sylius endpoint. When a victim visits the attacker's page and clicks the link, their browser sends a request to the Sylius application with the Referer header set to the attacker's domain. The Sylius application processes the request and redirects the user to the URL specified in the Referer header, sending them to the attacker-controlled site.

For example, an attacker could host a page at https://malicious-site.example.com/ containing a link to https://legitimate-sylius-store.com/currency/switch/USD. When clicked, the browser sends the request with Referer: https://malicious-site.example.com/. The vulnerable Sylius controller then redirects the user to the malicious site. From there, the attacker could present a convincing phishing page designed to harvest credentials or sensitive information, leveraging the trust established by the redirect originating from the legitimate domain.

Detection Methods for CVE-2026-31819

Indicators of Compromise

• Unusual redirect patterns in web server logs showing redirects to external domains after currency switch, locale switch, or impersonation actions
• HTTP requests to /currency/switch/*, /locale/switch/*, or admin impersonation endpoints with Referer headers pointing to suspicious external domains
• User reports of being unexpectedly redirected to unfamiliar sites after interacting with the Sylius store

Detection Strategies

• Monitor web application firewall (WAF) logs for requests to vulnerable endpoints with external Referer headers
• Implement log analysis rules to alert on redirect responses (HTTP 302/303) that target external domains from the affected controller actions
• Review Symfony application logs for patterns indicating potential exploitation attempts

Monitoring Recommendations

• Enable verbose access logging on the web server to capture Referer headers for forensic analysis
• Configure security monitoring tools to correlate redirect events with Referer header anomalies
• Implement real-time alerting for administrators when impersonation endpoints receive requests with non-local Referer values

How to Mitigate CVE-2026-31819

Immediate Actions Required

• Upgrade Sylius to the latest patched version immediately: 1.9.12, 1.10.16, 1.11.17, 1.12.23, 1.13.15, 1.14.18, 2.0.16, 2.1.12, or 2.2.3 depending on your current major/minor version
• Review web server and application logs for evidence of exploitation attempts prior to patching
• Educate administrators about the risks of clicking external links while authenticated to the admin panel
• Consider implementing a Content Security Policy (CSP) that restricts form actions and navigation targets

Patch Information

Sylius has released security patches addressing this vulnerability across all supported version branches. The fix implements proper validation of the Referer header before using it as a redirect target, ensuring redirects only occur to trusted internal URLs. Detailed patch information is available in the GitHub Security Advisory.

Patched versions include:

• 1.9.12 and above
• 1.10.16 and above
• 1.11.17 and above
• 1.12.23 and above
• 1.13.15 and above
• 1.14.18 and above
• 2.0.16 and above
• 2.1.12 and above
• 2.2.3 and above

Workarounds

• Deploy a web application firewall (WAF) rule to validate or strip Referer headers containing external domains for requests to the affected endpoints
• Implement reverse proxy rules to override the redirect behavior for the vulnerable controller actions, forcing redirects to a safe default location such as the homepage
• Restrict access to administrative endpoints at the network level to trusted IP ranges, reducing the attack surface for the ImpersonateUserController endpoint

# Example Nginx configuration to block external referers on vulnerable endpoints
location ~ ^/(currency|locale)/switch/ {
    if ($http_referer !~* "^https?://(www\.)?yourdomain\.com") {
        return 403;
    }
    proxy_pass http://backend;
}