UBUNTU-CVE-2026-48489
A vulnerability in the Symfony PHP framework prior to versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13 allows unauthenticated login failure requests to dispatch subrequests to protected GET routes when failure_forward is enabled. This could bypass firewall listeners and access control protections. The issue is fixed in the specified versions.
AI Analysis
Technical Summary
Symfony versions before 5.4.53, 6.4.41, 7.4.13, and 8.0.13 contain a vulnerability in the DefaultAuthenticationFailureHandler component. When the failure_forward option is set to true, the handler honors the request-supplied _failure_path parameter. This allows an unauthenticated failing login request to dispatch a subrequest to GET routes protected by access control, which skip firewall listeners, potentially bypassing security controls. The vulnerability is resolved in the fixed versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to dispatch subrequests to access control-protected GET routes that bypass firewall listeners, potentially gaining unauthorized access to protected resources or information. The vulnerability affects the security boundary of the application by allowing bypass of firewall protections during authentication failure handling.
Mitigation Recommendations
This vulnerability is fixed in Symfony versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. Users should upgrade to these or later versions to remediate the issue. No other mitigation is indicated by the vendor advisory.
UBUNTU-CVE-2026-48489
Description
A vulnerability in the Symfony PHP framework prior to versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13 allows unauthenticated login failure requests to dispatch subrequests to protected GET routes when failure_forward is enabled. This could bypass firewall listeners and access control protections. The issue is fixed in the specified versions.
CVSS v4.0
Affected software
pkg:deb/ubuntu/[email protected]?arch=source&distro=xenialpkg:deb/ubuntu/[email protected]+dfsg-1ubuntu0.1+esm2?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/[email protected]+dfsg-1ubuntu1+esm2?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/[email protected]+dfsg-1ubuntu8+esm1?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/[email protected]+dfsg-3ubuntu3+esm1?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/[email protected]+dfsg-1?arch=source&distro=questingpkg:deb/ubuntu/[email protected]+dfsg-1ubuntu1?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Symfony versions before 5.4.53, 6.4.41, 7.4.13, and 8.0.13 contain a vulnerability in the DefaultAuthenticationFailureHandler component. When the failure_forward option is set to true, the handler honors the request-supplied _failure_path parameter. This allows an unauthenticated failing login request to dispatch a subrequest to GET routes protected by access control, which skip firewall listeners, potentially bypassing security controls. The vulnerability is resolved in the fixed versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Potential Impact
An unauthenticated attacker can exploit this vulnerability to dispatch subrequests to access control-protected GET routes that bypass firewall listeners, potentially gaining unauthorized access to protected resources or information. The vulnerability affects the security boundary of the application by allowing bypass of firewall protections during authentication failure handling.
Mitigation Recommendations
This vulnerability is fixed in Symfony versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. Users should upgrade to these or later versions to remediate the issue. No other mitigation is indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-48489
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:25.10","Ubuntu:26.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 4.0
Threat ID: 6a58b49a68715ace43da82db
Added to database: 07/16/2026, 10:38:18 UTC
Last enriched: 07/16/2026, 12:28:21 UTC
Last updated: 07/16/2026, 12:28:21 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.