Symfony UX LiveComponent CVE-2026-49212
LOWSeverity by source
Network-reachable endpoint (AV:N); high complexity requires matching prop key names across components (AC:H); application session access needed (PR:L); impact limited to component-state integrity and secondary disclosure (C:L/I:L/A:N).
Lifecycle Timeline
2DescriptionCVE.org
Description
In symfony/ux-live-component, a component's server-side state is exposed to the browser as a set of props (#[LiveProp]-annotated properties). Props marked writable: true can be freely changed by the client. Read-only props are round-tripped to the browser and back, and their integrity is protected by an HMAC so the client cannot tamper with them. Child components additionally receive a propsFromParent blob, also HMAC-signed.
The HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only the sorted prop key/value pairs. It didn't include the component name, the slot identifier (props vs propsFromParent), or any request context, and a single application-wide secret is used for every component. A signed blob the server minted for component A is therefore a valid signature for component B if the key names happen to match, and a props blob can be replayed in the propsFromParent slot (or the reverse). An attacker can use this to set a read-only prop on a target component to a value they were only ever allowed to choose as a writable prop on another component.
Resolution
The HMAC is now bound to its context: the component name and a slot identifier are included in the pre-image before hashing. Two constants (CHECKSUM_SLOT_PROPS and CHECKSUM_SLOT_PROPS_FROM_PARENT) name the two slots, and calculateChecksum(), verifyChecksum(), addChecksumToData(), and ChildComponentPartialRenderer thread these values through. Cross-component and cross-slot replays no longer verify.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Credits
Symfony would like to thank Anthropic (via Project Glasswing) for reporting the issue and Hugo Alliaume for providing the fix.
AnalysisAI
Symfony/ux-live-component's LiveComponentHydrator computes HMAC checksums over prop key/value pairs alone, omitting the component name and slot identifier, enabling cross-component and cross-slot HMAC replay attacks. Any user able to interact with a LiveComponent-enabled page can capture a valid signed props blob minted for component A and submit it as component B's props (when key names overlap), or substitute a props blob into the propsFromParent slot, bypassing read-only prop integrity protection and forcing server-side component state to attacker-chosen values. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires symfony/ux-live-component version 2.8.0-2.35.x or 3.0.0-3.0.x deployed in an application that exposes at least two LiveComponent types sharing the same prop key name - where one component treats that key as a writable prop and the other as a read-only prop. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS score or vector is provided in the input; all metric assessments below are independently derived. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid browser session on an application exposes two LiveComponents - for example, a product-search component with a writable `categoryId` prop and an order-billing component with a read-only `categoryId` prop sharing the same key name. The attacker sets `categoryId` to an attacker-controlled value via the search component and captures the resulting HMAC-signed props blob from the server response, then crafts an HTTP request to the billing component's live endpoint, substituting that blob as the billing component's props payload. … |
| Remediation | Upgrade symfony/ux-live-component to version 2.36.0 (2.x branch) or 3.1.0 (3.x branch) via `composer require symfony/ux-live-component:^2.36` or `^3.1` respectively. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today