CVE-2026-48489 Details
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
A vulnerability in Symfony's DefaultAuthenticationFailureHandler component can lead to unauthorized access to protected GET routes. This issue affects Symfony versions prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13. When the failure_forward option is enabled, the handler incorrectly honors user-supplied _failure_path parameters. This allows an unauthenticated user to exploit failing login requests by dispatching subrequests to access control-protected routes, bypassing firewall listeners. As a result, GET endpoints in administrative areas can be accessed without authentication.
Users can update to Symfony versions 5.4.53, 6.4.41, 7.4.13, or 8.0.13 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/symfony/symfony/commit/c48a4276309e11aedeeb0ce3a89dfbf0b4fe04ff | [email protected] | Patch |
| https://github.com/symfony/symfony/releases/tag/v5.4.53 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v6.4.41 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/releases/tag/v7.4.13 | [email protected] | ProductRelease Notes |
| https://github.com/symfony/symfony/security/advisories/GHSA-6h46-9jf5-q59x | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| sensiolabs symfony | < 5.4.53 >= 6.0.0, < 6.4.41 >= 7.0.0, < 7.4.13 >= 8.0.0, < 8.0.13 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | New CVE Received | [email protected] |