EUVD-2026-45209
GHSA-34w5-c283-j9fg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint (AV:N); high complexity requires matching prop key names across components (AC:H); application session access needed (PR:L); impact limited to component-state integrity and secondary disclosure (C:L/I:L/A:N).
Primary rating from Vendor (https://github.com/symfony/ux).
CVSS VectorVendor: https://github.com/symfony/ux
Lifecycle Timeline
3DescriptionCVE.org
Description
In symfony/ux-live-component, a component's server-side state is exposed to the browser as a set of props (#[LiveProp]-annotated properties). Props marked writable: true can be freely changed by the client. Read-only props are round-tripped to the browser and back, and their integrity is protected by an HMAC so the client cannot tamper with them. Child components additionally receive a propsFromParent blob, also HMAC-signed.
The HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only the sorted prop key/value pairs. It didn't include the component name, the slot identifier (props vs propsFromParent), or any request context, and a single application-wide secret is used for every component. A signed blob the server minted for component A is therefore a valid signature for component B if the key names happen to match, and a props blob can be replayed in the propsFromParent slot (or the reverse). An attacker can use this to set a read-only prop on a target component to a value they were only ever allowed to choose as a writable prop on another component.
Resolution
The HMAC is now bound to its context: the component name and a slot identifier are included in the pre-image before hashing. Two constants (CHECKSUM_SLOT_PROPS and CHECKSUM_SLOT_PROPS_FROM_PARENT) name the two slots, and calculateChecksum(), verifyChecksum(), addChecksumToData(), and ChildComponentPartialRenderer thread these values through. Cross-component and cross-slot replays no longer verify.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Credits
Symfony would like to thank Anthropic (via Project Glasswing) for reporting the issue and Hugo Alliaume for providing the fix.
AnalysisAI
Symfony/ux-live-component's LiveComponentHydrator computes HMAC checksums over prop key/value pairs alone, omitting the component name and slot identifier, enabling cross-component and cross-slot HMAC replay attacks. Any user able to interact with a LiveComponent-enabled page can capture a valid signed props blob minted for component A and submit it as component B's props (when key names overlap), or substitute a props blob into the propsFromParent slot, bypassing read-only prop integrity protection and forcing server-side component state to attacker-chosen values. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
symfony/ux-live-component (pkg:composer/symfony/ux-live-component) is a PHP package implementing server-driven reactive UI components where #[LiveProp]-annotated properties represent component state. Read-only props are serialized and round-tripped through the browser as HMAC-signed blobs to prevent client tampering; child components receive a separate propsFromParent blob, also HMAC-signed. The root cause is CWE-345 (Insufficient Verification of Data Authenticity): LiveComponentHydrator::calculateChecksum() constructed its HMAC pre-image as json_encode(sorted_key_value_pairs) only, without binding it to the component name or the slot (props vs propsFromParent). Because a single application-wide secret is shared across all components, any valid HMAC minted for one component is cryptographically indistinguishable from one minted for another component that happens to share the same prop key names. The fix binds the pre-image as componentName + NUL + slot + NUL + json_encode(data), making cross-component and cross-slot replays verifiably invalid.
RemediationAI
Upgrade symfony/ux-live-component to version 2.36.0 (2.x branch) or 3.1.0 (3.x branch) via composer require symfony/ux-live-component:^2.36 or ^3.1 respectively. The patching commit is available at https://github.com/symfony/ux/commit/a224b5af3e2e33ee14ac71356ae0e0877900a81c and the advisory at https://github.com/symfony/ux/security/advisories/GHSA-34w5-c283-j9fg. Note an intentional backward-compatibility break: any browser session holding a pre-upgrade HMAC-signed payload will fail checksum verification after the upgrade and must reload the page - this is expected behavior, not an error. No configuration-level workaround exists; the flaw is in the HMAC construction itself, so no firewall rule or WAF signature can reliably detect cross-component blob substitution. If immediate patching is not possible, consider disabling LiveComponent functionality entirely for the highest-sensitivity components as a temporary measure, accepting the loss of that UI feature until the patch is applied.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today