CVE-2026-49212: 
PHP vulnerability analysis and mitigation

CVE-2026-49212 is an HMAC signature replay vulnerability in the symfony/ux-live-component package (Symfony UX) where the LiveComponentHydrator class computes checksums that lack binding to the component name, slot identifier, or request context. This allows a signed prop blob minted for one component or slot to be replayed against another, enabling an attacker to set read-only props on a target component to unauthorized values. Affected versions are >=2.8.0, <2.36.0 and >=3.0.0, <3.1.0. The vulnerability was disclosed on May 29, 2026, and carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Symfony Advisory, Github Advisory).

The root cause is CWE-345 (Insufficient Verification of Data Authenticity): the calculateChecksum() method in LiveComponentHydrator hashed only the sorted prop key/value pairs using a single application-wide secret, without including the component name, slot identifier (props vs. propsFromParent), or any request context in the HMAC pre-image (Github Advisory). Because the same secret is shared across all components, a valid HMAC blob generated for Component A is cryptographically indistinguishable from one for Component B if their prop key names match. An unauthenticated attacker can intercept or observe a signed blob from one component (e.g., as a writable prop) and replay it against another component's read-only prop slot, or replay a props blob into the propsFromParent slot. The fix binds the HMAC pre-image to componentName + "\0" + slot + "\0" + json_encode(props), using two new constants CHECKSUM_SLOT_PROPS and CHECKSUM_SLOT_PROPS_FROM_PARENT (Patch Commit).

Successful exploitation allows an unauthenticated attacker to tamper with the integrity of server-side component state by setting read-only #[LiveProp]-annotated properties to values they should not be able to control, bypassing the intended access control enforced by the HMAC signature scheme. There is no confidentiality or availability impact; the impact is limited to integrity of the vulnerable system's component state. Depending on application logic, this could allow attackers to manipulate business-critical data, bypass authorization checks enforced via read-only props, or inject unexpected values into child component rendering pipelines (Github Advisory, Symfony Advisory).

1. Reconnaissance: Identify a target Symfony application using symfony/ux-live-component versions >=2.8.0, <2.36.0 or >=3.0.0, <3.1.0 by inspecting HTTP responses for LiveComponent-specific attributes (e.g., data-live-props, data-live-checksum) in the page source.
2. Identify components and prop structures: Browse the application and capture LiveComponent AJAX requests/responses to enumerate component names and their dehydrated prop blobs (JSON objects containing prop key/value pairs and an @checksum field).
3. Find prop key overlap: Identify two components where Component A has a writable prop (e.g., userId) and Component B has a read-only prop with the same key name (userId). The HMAC for Component A's blob will be valid for Component B due to the missing context binding.
4. Capture a signed blob: Interact with Component A as a normal user to obtain a server-signed prop blob containing the desired value for the shared key (e.g., {"userId": 999, "@checksum": "<valid_hmac>"}).
5. Replay the blob: Craft a LiveComponent update request targeting Component B, substituting Component B's props payload with the blob captured from Component A (or replay a props blob into the propsFromParent slot).
6. Achieve unauthorized prop modification: The server accepts the replayed HMAC as valid and hydrates Component B with the attacker-controlled value for the read-only prop, bypassing the intended integrity protection (Github Advisory, Patch Commit).

• Network: Unusual LiveComponent AJAX requests (typically POST to /live-component or similar endpoints) where the props payload's @checksum value does not correspond to the component name visible in the request; requests replaying identical @checksum values across different component endpoints.
• Logs: Server-side Symfony application logs showing HydrationException errors with messages like "Invalid checksum sent when updating the live component." or "Invalid checksum for the data sent from the parent component." — these may indicate failed replay attempts; absence of such errors despite cross-component prop manipulation may indicate successful exploitation on unpatched systems.
• Application Behavior: Unexpected or unauthorized values appearing in read-only #[LiveProp] fields during component hydration, particularly values that should only be settable via a different component's writable props.

Upgrade symfony/ux-live-component to version 2.36.0 (for the 2.x branch) or 3.1.0 (for the 3.x branch), both released on May 29, 2026 (Symfony Advisory, v2.36.0 Release, v3.1.0 Release). No configuration-based workaround is available; patching is the only remediation. Note that after upgrading, any existing signed prop blobs in users' browsers will be invalidated and users will need to reload their pages, as the HMAC pre-image format has changed (Patch Commit).

The vulnerability was reported by Anthropic via Project Glasswing and fixed by Hugo Alliaume (Kocal), as credited in the official advisory (Github Advisory). The fix was released as part of a broader security batch in Symfony UX v2.36.0 and v3.1.0, which addressed six security issues simultaneously, suggesting a coordinated security release effort by the Symfony team (v2.36.0 Release). No significant public social media discussion or independent researcher commentary has been identified beyond the official advisory.