CVE-2026-49212

Name of the Vulnerable Software and Affected Versions Symfony UX versions 2.8.0 through 2.35.0 Symfony UX versions 3.0.0 through 3.0.x

Description In symfony/ux-live-component, the server-side state of a component is exposed to the browser as props. While read-only props are protected by an HMAC (Hash-based Message Authentication Code) to prevent client-side tampering, the HMAC computed by SymfonyUXLiveComponentLiveComponentHydrator only covered sorted prop key/value pairs. It failed to include the component name, the slot identifier (props versus propsFromParent), or the request context. Because a single application-wide secret is used for all components, a signed blob created for one component or slot can be replayed in another if the key names match. This allows an attacker to set a read-only prop on a target component using a value they were permitted to set as a writable prop on a different component.

Recommendations Update Symfony UX to version 2.36.0. Update Symfony UX to version 3.1.0.