CVE-2026-49212: Symfony UX Auth Bypass Vulnerability

CVE-2026-49212 Overview

CVE-2026-49212 is an insufficient verification of data authenticity vulnerability [CWE-345] in Symfony UX LiveComponent. The Symfony\UX\LiveComponent\LiveComponentHydrator component computed an HMAC over sorted prop key/value pairs only. The checksum did not incorporate the component name, the slot identifier (props vs propsFromParent), or request context. Attackers can replay a signed blob minted for one component or slot in another component to overwrite a read-only prop on a target component. The flaw affects Symfony UX versions from 2.8.0 up to 2.36.0 and 3.1.0. Maintainers released fixes in versions 2.36.0 and 3.1.0.

Critical Impact
Attackers can replay valid HMAC-signed prop payloads across components to modify read-only properties, breaking integrity guarantees of LiveComponent parent-child data binding.

Affected Products

Symfony UX LiveComponent versions 2.8.0 through 2.35.x
Symfony UX LiveComponent version 3.0.0
All applications embedding Symfony LiveComponent parent-child rendering

Discovery Timeline

2026-07-17 - CVE-2026-49212 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49212

Vulnerability Analysis

The vulnerability resides in the LiveComponent hydration layer, which uses an HMAC checksum to enforce prop integrity between server and client. The checksum protects against tampering by signing serialized prop data. However, the signature scope was too narrow. The HMAC covered only the sorted key/value pairs of the prop set, omitting any binding to the specific component instance or slot type consuming the data.

Because of this narrow scope, a signed payload minted for ComponentA remains cryptographically valid when submitted against ComponentB. The same weakness applies across slot boundaries. A blob signed for the props slot can be replayed into the propsFromParent slot. This slot is intended to receive read-only values from a parent component. The consequence is a targeted integrity failure where attackers overwrite read-only props on a target component using a legitimately signed payload from another context.

Root Cause

The root cause is missing context binding in HMAC input construction. The signing routine did not include a component identifier or slot discriminator alongside the prop payload, violating the principle that authenticated data must be uniquely tied to its intended usage context.

Attack Vector

An attacker who can obtain a signed prop blob from any LiveComponent interaction replays that blob against a different component or slot in a subsequent request. The attack requires no authentication and no user interaction. Exploitation is bounded to integrity impact on component state, not code execution.

php

// Security patch in src/LiveComponent/src/Util/ChildComponentPartialRenderer.php
// [LiveComponent] Bind HMAC checksum to component name and slot

// only send back the props that are allowed to be updated from the parent
$readonlyDehydratedProps = $liveMetadata->getOnlyPropsThatAcceptUpdatesFromParent($props);
-$readonlyDehydratedProps = $this->getLiveComponentHydrator()->addChecksumToData($readonlyDehydratedProps);
+$readonlyDehydratedProps = $this->getLiveComponentHydrator()->addChecksumToData(
+    $readonlyDehydratedProps,
+    $componentName,
+    LiveComponentHydrator::CHECKSUM_SLOT_PROPS_FROM_PARENT,
+);

$attributesCollection->setPropsUpdatedFromParent($readonlyDehydratedProps);
$attributes = $attributes->toArray();

Source: Symfony UX Commit a224b5af

Detection Methods for CVE-2026-49212

Indicators of Compromise

LiveComponent POST requests where the submitted component name does not match historical prop patterns for that user session
Repeated identical HMAC checksum values observed across requests targeting different _live_component endpoints
Unexpected changes to read-only props observed in application audit logs following LiveComponent updates

Detection Strategies

Inspect Symfony application logs for LiveComponent hydration events that mutate props marked as read-only or writable: false
Correlate _checksum field values across requests to identify replay of the same signed blob against different component targets
Enable verbose logging on the LiveComponentHydrator service to capture component name and slot metadata for each hydration call

Monitoring Recommendations

Monitor HTTP request bodies to Symfony LiveComponent endpoints for anomalous data and _checksum reuse patterns
Track application-level integrity anomalies where component state diverges from server-issued values
Baseline the set of components a given user session interacts with and alert on cross-component checksum reuse

How to Mitigate CVE-2026-49212

Immediate Actions Required

Upgrade Symfony UX LiveComponent to version 2.36.0 for the 2.x branch or 3.1.0 for the 3.x branch immediately
Audit application code for LiveComponents that expose sensitive read-only props from parent components
Review recent LiveComponent traffic for suspicious checksum reuse across distinct component names

Patch Information

The fix is available in Symfony UX versions 2.36.0 and 3.1.0. The patch modifies addChecksumToData() to incorporate the component name and a slot discriminator constant (CHECKSUM_SLOT_PROPS_FROM_PARENT or CHECKSUM_SLOT_PROPS) into the HMAC input. See the GitHub Security Advisory GHSA-34w5-c283-j9fg and the GitHub Release v2.36.0 or GitHub Release v3.1.0 notes.

Workarounds

No official workaround exists; upgrade to a patched release
If patching is delayed, minimize the exposure of read-only props by restricting parent-to-child data flow to non-sensitive fields
Consider disabling parent-controlled prop updates on components handling authorization or access decisions until the upgrade is complete

bash

# Upgrade Symfony UX LiveComponent via Composer
composer require symfony/ux-live-component:^2.36.0
# or for the 3.x branch
composer require symfony/ux-live-component:^3.1.0

# Verify installed version
composer show symfony/ux-live-component | grep versions