SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-49215

MEDIUM · CVSS 5.4 EPSS 0.12% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-17 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

The vulnerability affects Symfony UX versions 2.22.0 to 2.36.0 and 3.1.0, allowing attackers to exploit the isLiveComponentRequest() method to forge cross-origin #[LiveAction] requests. This can compromise user sessions when applications utilize permissive cookie policies and configurations like SameSite=None and credentials: 'include'. Developers and security teams using affected versions should prioritize upgrading to versions 2.36.0 or 3.1.0 to mitigate the risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-49215
Severity
MEDIUM
CVSS
5.4
EPSS
0.12%
Java

Original NVD Description

Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0.

Related CVEs

Other vulnerabilities affecting the same vendor(s)