CVE-2026-48489: Symfony firewall bypass via failure_forward subrequest in security-http

CVE-2026-48489 · Severity: high · CVSS 0 · Published 2026-07-14

A security flaw in the Symfony web framework allows unauthorized users to bypass security firewalls and access protected administrative pages or data. By sending a specially crafted login request that intentionally fails, an attacker can trick the system into displaying internal pages that should require a password. This could lead to the exposure of sensitive information, such as internal reports, user data, or administrative dashboards, even if the application is otherwise correctly configured.

Technologies: symfony/security-http (Packagist), symfony/symfony (Packagist), Symfony Security HTTP. Vendors: Packagist, Symfony.

Quick answers

Is CVE-2026-48489 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48489 being exploited in the wild.
How severe is CVE-2026-48489?
High severity, with a CVSS score of 0, published 14 July 2026.
Which products and versions are affected?
symfony/security-http (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.53; symfony/symfony (Packagist) ECOSYSTEM:introduced=0,fixed=5.4.53; Symfony Security HTTP < 5.4.53, >= 6.0.0-BETA1 < 6.4.41, >= 7.0.0-BETA1 < 7.4.13, >= 8.0.0-BETA1 < 8.0.13, < 5.4.53, >= 6.0.0, < 6.4.41, >= 7.0.0, < 7.4.13, >= 8.0.0, < 8.0.13.
Is there a fix for CVE-2026-48489?
Yes. symfony/security-http (Packagist): upgrade to 5.4.53 or later; symfony/symfony (Packagist): upgrade to 5.4.53 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48489 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48489?
Check whether you run symfony/security-http (Packagist), symfony/symfony (Packagist) or Symfony Security HTTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • symfony/security-http (Packagist): upgrade to 5.4.53 or later
    composer require symfony/security-http:^5.4.53
  • symfony/symfony (Packagist): upgrade to 5.4.53 or later
    composer require symfony/symfony:^5.4.53

Technical details

An authorization bypass exists in Symfony's DefaultAuthenticationFailureHandler when the 'failure_forward' configuration is set to true. The handler incorrectly honors the '_failure_path' parameter provided in a login request, using it to dispatch an internal subrequest via HttpKernelInterface::SUB_REQUEST. Because Symfony's Firewall listener is designed to skip subrequests, the AccessListener (which enforces access_control rules) is bypassed. An unauthenticated attacker can exploit this by submitting a failing login request with a malicious '_failure_path' to access any GET route protected by the firewall. The issue is resolved in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13 by ensuring the handler only uses the developer-configured failure path.

Affected products

  • Symfony symfony/symfony < 5.4.53, >= 6.0.0-BETA1 < 6.4.41, >= 7.0.0-BETA1 < 7.4.13, >= 8.0.0-BETA1 < 8.0.13
  • Symfony symfony/security-http < 5.4.53, >= 6.0.0-BETA1 < 6.4.41, >= 7.0.0-BETA1 < 7.4.13, >= 8.0.0-BETA1 < 8.0.13

Identifiers

  • CVE-2026-48489
  • GHSA-6h46-9jf5-q59x

Timeline

  • 2026-05-27: patched: Security releases v5.4.53, v6.4.41, v7.4.13, and v8.0.13 published.
  • 2026-07-14: disclosed: CVE-2026-48489 published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.