CVE-2026-49215: 
PHP vulnerability analysis and mitigation

CVE-2026-49215 is a Cross-Site Request Forgery (CSRF) protection bypass vulnerability in the symfony/ux-live-component package. The flaw exists because LiveComponentSubscriber::isLiveComponentRequest() relied solely on the Accept: application/vnd.live-component+html header to gate #[LiveAction] invocations — a header that is CORS-safelisted and can be set by cross-origin fetch() calls without triggering a preflight request. Affected versions are >=2.22.0, <2.36.0 and >=3.0.0, <3.1.0 of symfony/ux. The vulnerability was first disclosed by Symfony on May 29, 2026, and published to the GitHub Advisory Database on June 19, 2026. It carries a CVSS v3.1 score of 5.4 (Medium) and a CVSS v4.0 score of 2.1 (Low) (Symfony Advisory, Github Advisory).

The root cause is CWE-352 (Cross-Site Request Forgery): the application incorrectly treated a CORS-safelisted HTTP request header (Accept: application/vnd.live-component+html) as a CSRF protection mechanism. Per the Fetch specification (§3.2.2), CORS-safelisted headers do not trigger a browser preflight OPTIONS request, meaning a malicious cross-origin page can craft a fetch() call with this header and have the browser attach the victim's session cookies — bypassing the intended gate entirely. The attack requires user interaction (the victim must visit an attacker-controlled page) and is most effective against applications configured with SameSite=None cookies, credentials: 'include', or a permissive cookie policy; applications using Symfony's default SameSite=Lax are largely mitigated by browser cookie policy. The fix adds a mandatory check for X-Requested-With: XMLHttpRequest, a non-CORS-safelisted header that forces a preflight for cross-origin requests, which Symfony's LiveComponent endpoints do not satisfy (Github Advisory, Patch Commit).

Successful exploitation allows an unauthenticated attacker to forge cross-origin requests that invoke any #[LiveAction]-annotated method within a victim's authenticated session, mutating server-side application state without the victim's knowledge or consent. The confidentiality and integrity impacts are limited (low) — an attacker can read or modify data accessible to the victim's session via exposed LiveActions, but there is no availability impact and no impact on subsequent systems. Applications using SameSite=None cookies, credentials: 'include', or a permissive cookie policy are at highest risk, while those using the default SameSite=Lax have a significant practical mitigation (Github Advisory, Symfony Advisory).

1. Identify a target application: Locate a Symfony application using symfony/ux-live-component versions >=2.22.0, <2.36.0 or >=3.0.0, <3.1.0 that exposes #[LiveAction] methods and is configured with SameSite=None session cookies or a permissive cookie policy.
2. Enumerate LiveAction endpoints: Review the application's source or JavaScript bundles to identify available #[LiveAction] method names and their expected request parameters (e.g., component name, action name, props payload).
3. Craft a malicious page: Create an attacker-controlled web page that uses the browser's fetch() API to send a cross-origin POST request to the target's LiveComponent endpoint (e.g., /_components/{ComponentName}/{actionName}), setting the Accept: application/vnd.live-component+html header and including a JSON body with the desired props.
4. Lure the victim: Trick an authenticated victim into visiting the malicious page (e.g., via phishing). Because the Accept header is CORS-safelisted, the browser sends the request without a preflight and attaches the victim's session cookies.
5. Achieve state mutation: The server processes the forged #[LiveAction] invocation within the victim's session, mutating server-side state as intended by the attacker (e.g., changing account settings, submitting forms, or triggering privileged operations exposed via LiveActions) (Github Advisory, Symfony Advisory).

• Network: Unexpected POST requests to /_components/{ComponentName}/{actionName} endpoints originating from cross-origin referrers (check Referer or Origin headers in access logs that do not match the application's own domain); absence of the X-Requested-With: XMLHttpRequest header in LiveComponent requests on unpatched systems.
• Logs: Web server or application access logs showing LiveComponent endpoint requests with Origin headers from external domains, particularly without a corresponding preflight OPTIONS request; requests with Accept: application/vnd.live-component+html but missing X-Requested-With.
• Application Behavior: Unexpected or unauthorized state changes in the application (e.g., modified user settings, submitted forms, triggered actions) that correlate with no direct user activity in the application UI (Github Advisory).

Upgrade symfony/ux-live-component to version 2.36.0 (for the 2.x branch) or 3.1.0 (for the 3.x branch), which add a mandatory X-Requested-With: XMLHttpRequest header check to isLiveComponentRequest(). The bundled Stimulus client already sends this header, so standard usage is unaffected after upgrading. For applications that cannot patch immediately: enforce SameSite=Lax (or Strict) on session cookies (Symfony's default), avoid SameSite=None where possible, and review cookie policies for unnecessary permissiveness. Applications that have implemented additional CSRF token validation for #[LiveAction] methods are protected regardless of this header issue. Cross-origin callers of LiveComponent endpoints must add X-Requested-With to their CORS Access-Control-Allow-Headers allow-list after patching (Symfony Advisory, Github Advisory, v2.36.0 Release, v3.1.0 Release).

The vulnerability was reported by Anthropic via Project Glasswing and fixed by Hugo Alliaume (Kocal), with the advisory published by nicolas-grekas. A Reddit discussion in the r/symfony community noted the issue shortly after disclosure. The fix was part of a broader security release (v2.36.0 / v3.1.0) that addressed six other CVEs in the Symfony UX ecosystem simultaneously, suggesting a coordinated security audit (Symfony Advisory, v2.36.0 Release).