CVE-2026-49212: CWE-345: Insufficient Verification of Data Authenticity in symfony ux
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0.
AI Analysis
Technical Summary
Symfony UX's LiveComponentHydrator computed HMAC signatures covering only sorted property key/value pairs, omitting critical context such as component name, slot identifier, and request context. This omission allowed replay attacks where a signed blob for one component or slot could be reused in another, enabling unauthorized modification of read-only properties. The vulnerability affects versions from 2.8.0 until 2.36.0 and 3.1.0. Fixes were introduced in versions 2.36.0 and 3.1.0 to include these context elements in the HMAC computation, preventing such replay attacks.
Potential Impact
An attacker can replay a signed data blob minted for one component or slot in another, potentially setting read-only properties on target components. This could lead to unauthorized data manipulation within the affected Symfony UX components. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.
Mitigation Recommendations
Upgrade affected Symfony UX versions to 2.36.0 or later, or 3.1.0 or later, where the issue is fixed by including component name, slot identifier, and request context in the HMAC computation. Patch status is confirmed by the version information in the description. No other mitigations are indicated.
CVE-2026-49212: CWE-345: Insufficient Verification of Data Authenticity in symfony ux
Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0.
CVSS v4.0
Score 6.9medium
Affected software
pkg:github/symfony/uxRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Symfony UX's LiveComponentHydrator computed HMAC signatures covering only sorted property key/value pairs, omitting critical context such as component name, slot identifier, and request context. This omission allowed replay attacks where a signed blob for one component or slot could be reused in another, enabling unauthorized modification of read-only properties. The vulnerability affects versions from 2.8.0 until 2.36.0 and 3.1.0. Fixes were introduced in versions 2.36.0 and 3.1.0 to include these context elements in the HMAC computation, preventing such replay attacks.
Potential Impact
An attacker can replay a signed data blob minted for one component or slot in another, potentially setting read-only properties on target components. This could lead to unauthorized data manipulation within the affected Symfony UX components. The vulnerability does not require privileges or user interaction and can be exploited remotely over the network.
Mitigation Recommendations
Upgrade affected Symfony UX versions to 2.36.0 or later, or 3.1.0 or later, where the issue is fixed by including component name, slot identifier, and request context in the HMAC computation. Patch status is confirmed by the version information in the description. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-28T03:42:34.340Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5b5eb62d1edb114c7fb659
Added to database: 07/18/2026, 11:08:38 UTC
Last enriched: 07/18/2026, 11:59:47 UTC
Last updated: 07/18/2026, 13:20:53 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.