CVE-2026-48489: Symfony Security Firewall Bypass Leading to Unauthenticated Access
Summary
CVE-2026-48489: Description When a firewall is configured with form-login (or any authenticator using DefaultAuthenticationFailureHandler) and the failure_forward: true option, the handler reads the _failure_path parameter from the fail... Affects symfony/security-http across 4 version ranges.
< 5.4.53
>= 6.0.0, < 6.4.41
>= 7.0.0, < 7.4.13
>= 8.0.0, < 8.0.13
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework used for building web applications. It provides a robust set of tools and libraries to facilitate the development process, including security features like firewalls and access control. However, a specific configuration involving the 'form-login' method can lead to a security vulnerability that allows unauthenticated users to access protected routes.
Vulnerability Detail
The vulnerability arises when a firewall is configured with 'form-login' and the 'failure_forward: true' option. In this scenario, the DefaultAuthenticationFailureHandler uses the '_failure_path' parameter from the login request to create an internal subrequest. Symfony's design assumes that subrequests are trusted, which leads to the AccessListener not being executed. This allows an attacker to manipulate the '_failure_path' to access protected GET routes without authentication, exposing sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.4.535.4.53composer require symfony/security-http:5.4.53 -
>= 6.0.0, < 6.4.416.4.41composer require symfony/security-http:6.4.41 -
>= 7.0.0, < 7.4.137.4.13composer require symfony/security-http:7.4.13 -
>= 8.0.0, < 8.0.138.0.13composer require symfony/security-http:8.0.13
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the 'failure_forward' option in your firewall configuration to prevent the bypass until you can apply the patch. This can be done by setting 'failure_forward: false' in your security configuration.
Conclusion
The CVE-2026-48489 vulnerability in Symfony poses a significant risk by allowing unauthenticated access to protected routes. It is crucial for developers using Symfony to apply the necessary updates to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for symfony/security-http →
FAQ
The vulnerability allows unauthenticated users to access protected GET routes, potentially exposing sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13 are affected by this vulnerability.
Yes, updating to the specified patched versions of Symfony will permanently resolve this vulnerability.
If an immediate update is not possible, consider disabling the 'failure_forward' option as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-http.
