CVE-2026-48489

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 5.4.21

Description When a firewall is configured with form-login (or any authenticator using DefaultAuthenticationFailureHandler) and the failure forward: true option, the handler reads the failure path parameter from the failing login request and uses it as the path of an internal subrequest dispatched through HttpKernelInterface::SUB REQUEST. Because the Firewall::onKernelRequest listener skips subrequests, the AccessListener (which evaluates access control) does not run. An unauthenticated attacker can use a POST request to the check path with a manipulated failure path parameter to perform a local request forgery, executing target controllers outside the firewall perimeter and accessing protected read-only GET endpoints, such as administrative areas, without authentication.

Recommendations Update to version 5.4.21 or later. As a temporary workaround, disable the failure forward option or restrict the use of the failure path parameter in login requests.