CVE-2026-48489

EUVD-2026-44374

14.07.2026, 20:17

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

symfony

bookworm	5.4.53+dfsg-0+deb12u1 fixed
bookworm (security)	5.4.53+dfsg-0+deb12u1 fixed
bullseye	vulnerable
bullseye (security)	vulnerable
forky	7.4.14+dfsg-1 fixed
sid	7.4.14+dfsg-1 fixed
trixie	6.4.41+dfsg-0+deb13u1 fixed
trixie (security)	6.4.41+dfsg-0+deb13u1 fixed

Common Weakness Enumeration

CWE-863 - Incorrect Authorization
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References

https://github.com/symfony/symfony/commit/c48a4276309e11aedeeb0ce3a89dfbf0b4fe04ff

https://github.com/symfony/symfony/releases/tag/v5.4.53

https://github.com/symfony/symfony/releases/tag/v6.4.41

https://github.com/symfony/symfony/releases/tag/v7.4.13

https://github.com/symfony/symfony/security/advisories/GHSA-6h46-9jf5-q59x