VYPR
High severity7.5OSV Advisory· Published Jul 14, 2026· Updated Jul 16, 2026

CVE-2026-48489

CVE-2026-48489

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
symfony/security-httpPackagist
< 5.4.535.4.53
symfony/symfonyPackagist
< 5.4.535.4.53
symfony/security-httpPackagist
>= 6.0.0, < 6.4.416.4.41
symfony/security-httpPackagist
>= 7.0.0, < 7.4.137.4.13
symfony/security-httpPackagist
>= 8.0.0, < 8.0.138.0.13
symfony/symfonyPackagist
>= 6.0.0, < 6.4.416.4.41
symfony/symfonyPackagist
>= 7.0.0, < 7.4.137.4.13
symfony/symfonyPackagist
>= 8.0.0, < 8.0.138.0.13

Affected products

2
  • Sensiolabs/SymfonyOSV2 versions
    v5.4.52, v7.4.12, v6.4.40, …+ 1 more
    • (no CPE)range: v5.4.52, v7.4.12, v6.4.40, …
    • (no CPE)range: <5.4.53, <6.4.41, <7.4.13, <8.0.13

Patches

Vulnerability mechanics

References

9

News mentions

0

No linked articles in our index yet.