CVE-2026-49215

Name of the Vulnerable Software and Affected Versions Symfony UX versions 2.22.0 through 2.35.0

Description Methods annotated with #[LiveAction] in the LiveComponent ecosystem can be invoked from the browser to mutate server-side state via AJAX. The function SymfonyUXLiveComponentEventListenerLiveComponentSubscriber::isLiveComponentRequest() previously relied on the Accept: application/vnd.live-component+html header for CSRF protection. However, because the Accept header is a CORS-safelisted request header, a cross-origin fetch() can set it without triggering a preflight request. This allows forged cross-origin #[LiveAction] requests against a victim session in applications using SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot.

Recommendations Update Symfony UX to version 2.36.0 or 3.1.0.