CVE-2026-49215: Symfony UX LiveComponent CSRF Vulnerability

CVE-2026-49215 Overview

CVE-2026-49215 is a Cross-Site Request Forgery (CSRF) vulnerability in Symfony UX LiveComponent. The flaw affects versions from 2.22.0 up to (but not including) 2.36.0, and version 3.1.0. The LiveComponentSubscriber::isLiveComponentRequest() method gated #[LiveAction] invocations solely on the Accept: application/vnd.live-component+html header. Because Accept is CORS-safelisted, cross-origin fetch() calls can set this header without triggering a preflight. Attackers can forge #[LiveAction] requests against a victim's authenticated session when applications rely on SameSite=None cookies, credentials: 'include', permissive cookie policies, or a same-origin pivot. The issue is tracked as [CWE-352] and is fixed in versions 2.36.0 and 3.1.0.

Critical Impact
Attackers can invoke arbitrary #[LiveAction] methods cross-origin against an authenticated user session, executing state-changing operations without the user's consent.

Affected Products

Symfony UX LiveComponent versions 2.22.0 through 2.35.x
Symfony UX LiveComponent version 3.0.0
Applications using SameSite=None cookies with credentials: 'include' fetch policies

Discovery Timeline

2026-07-17 - CVE-2026-49215 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-49215

Vulnerability Analysis

Symfony UX LiveComponent processes server-side actions annotated with #[LiveAction] via HTTP requests routed through the LiveComponentSubscriber event listener. To distinguish LiveComponent requests from ordinary requests, the subscriber's isLiveComponentRequest() method checked for the presence of application/vnd.live-component+html in the Accept header. The maintainers relied on this header check as a de facto CSRF mitigation, assuming same-origin policy would block cross-origin actors from setting it.

This assumption is incorrect. The Fetch specification §3.2.2 defines Accept as a CORS-safelisted request header, meaning browsers permit cross-origin fetch() calls to set it without issuing a preflight OPTIONS request. An attacker-controlled origin can therefore construct a fetch() call that submits the required Accept value and reaches the LiveComponent endpoint directly.

Root Cause

The root cause is a missing CSRF token or non-safelisted request header requirement on #[LiveAction] invocations. The subscriber treated a safelisted header as an origin discriminator, which browsers do not enforce as one.

Attack Vector

An attacker hosts a malicious page that issues a cross-origin fetch() to the victim application's LiveComponent endpoint. When the victim is authenticated and the session cookie is delivered (via SameSite=None with credentials: 'include', a permissive cookie policy, or a same-origin pivot such as a subdomain XSS), the forged request is executed under the victim's identity.

php

            return true;
        }

-        // Except when testing, require the correct content-type in the Accept header.
-        // This also acts as a CSRF protection since this can only be set in accordance with same-origin/CORS policies.
+        // Require a non-CORS-safelisted request header to force a preflight on
+        // cross-origin requests (which Symfony does not answer for LiveComponent
+        // endpoints), preventing CSRF. The Accept header alone is insufficient
+        // because it is CORS-safelisted (Fetch spec §3.2.2) and can be set
+        // cross-origin without a preflight.
+        if ('XMLHttpRequest' !== $request->headers->get('X-Requested-With')) {
+            return false;
+        }
+
        return \in_array(self::HTML_CONTENT_TYPE, $request->getAcceptableContentTypes(), true);
    }

Source: Symfony UX patch commit aed7493. The fix adds a required X-Requested-With: XMLHttpRequest header, which is not CORS-safelisted and therefore forces browsers to preflight cross-origin requests.

Detection Methods for CVE-2026-49215

Indicators of Compromise

Web server access logs showing requests to LiveComponent endpoints with an Origin or Referer header that does not match the application's own host.
Requests to #[LiveAction] routes containing Accept: application/vnd.live-component+html but lacking the X-Requested-With: XMLHttpRequest header.
Unexpected state changes tied to user sessions immediately after the user visited an untrusted third-party site.

Detection Strategies

Instrument the LiveComponent subscriber or a reverse proxy to log the Origin, Referer, and X-Requested-With headers on every LiveAction request.
Alert on any LiveAction request whose Origin header value is absent, null, or points to an external domain.
Correlate authenticated action events with the referring page origin recorded by front-end telemetry.

Monitoring Recommendations

Track the rate of LiveAction invocations per user session and flag anomalies against a baseline.
Monitor for spikes in 4xx responses on LiveComponent endpoints after applying the patch, which may indicate blocked cross-origin attempts.
Ingest web application logs into a centralized analytics pipeline to enable cross-request correlation and origin-based hunting.

How to Mitigate CVE-2026-49215

Immediate Actions Required

Upgrade Symfony UX LiveComponent to version 2.36.0 (for the 2.x branch) or 3.1.0 (for the 3.x branch).
Audit application session cookies and remove SameSite=None unless strictly required, preferring SameSite=Lax or SameSite=Strict.
Review recent LiveAction invocation logs for requests with foreign Origin or Referer values against authenticated sessions.

Patch Information

The fix landed in commit aed7493db2b4b7bf1f9c79b33cda544f06904b27 and is shipped in Symfony UX v2.36.0 and Symfony UX v3.1.0. The patched subscriber requires an X-Requested-With: XMLHttpRequest header, which is not CORS-safelisted. Cross-origin fetch() calls that attempt to include it will trigger a preflight, which Symfony does not answer for LiveComponent endpoints. Details are documented in GitHub Security Advisory GHSA-4m4j-hmqq-3gxm.

Workarounds

If patching is delayed, front the application with a reverse proxy that rejects LiveComponent requests lacking X-Requested-With: XMLHttpRequest.
Enforce SameSite=Lax or SameSite=Strict on session cookies to prevent them from being sent on cross-site fetch() calls.
Add an explicit Origin header allowlist check at the web server or middleware layer for LiveComponent endpoints.

bash

# Composer upgrade to patched release
composer require symfony/ux-live-component:^2.36.0
# Or, for the 3.x branch
composer require symfony/ux-live-component:^3.1.0