CVE-2026-48489

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48489
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48489.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48489
Aliases
Downstream
Published
2026-07-14T19:14:12.233Z
Modified
2026-07-18T03:41:50.834291181Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
Details

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied failurepath parameter when failureforward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to accesscontrol-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48489.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/symfony/security-http

Affected ranges

Type
GIT
Repo
https://github.com/symfony/security-http
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
119cc48b2370db276ed5ab81ef0458943645bcf9
Introduced
6530589fc40cdceda230fb6a69173ce52fa8b5ca
Fixed
1a01cd7a6313d5a375480e0d1d4a0ddf834ae12b
Introduced
f84d7d3c93e6a884908402775199b1f7d55c7be1
Fixed
da3c28025a664e6a88e1af104a74457d99301161
Introduced
bea6dc79db4d95c34b77ec27273d812aa64d65be
Fixed
ca895c1303cc1d290f190cd7301d48fcef9e73e5
Database specific 
{
    "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.53"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.4.41"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.4.13"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.13"
        }
    ],
    "source": "CPE_RANGE"
}
Type
GIT
Repo
https://github.com/symfony/symfony
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6436e377f7a82a1e7b120da519c7c96a154ece2a
Introduced
aa4e97099b5a67bdc9f2387fe8d099f5c712f81c
Fixed
14ff191853ad60d640c0853b4f17fc0f3b4de0ae
Introduced
d78c5f403d7ee794993660b1d5155536edd36fc1
Fixed
d9981b6e4c77b97472845a9b7fcba5507208aacc
Introduced
2e913a829cfbbf9cb38b321bdff1806b44b192eb
Fixed
ad82cb517407582bb697e079c5ee62bf8b7af3b7
Fixed
c48a4276309e11aedeeb0ce3a89dfbf0b4fe04ff
Database specific 
{
    "cpe": "cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4.53"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "fixed": "6.4.41"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.4.13"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.0.13"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.0-RC1
v2.0.0-RC2
v2.0.0-RC3
v2.0.0-RC4
v2.0.0-RC5
v2.0.0-RC6
v2.0.0BETA1
v2.0.0BETA2
v2.0.0BETA3
v2.0.0BETA4
v2.0.0BETA5
v2.0.0PR8
v2.1.0
v2.1.0-BETA1
v2.1.0-BETA2
v2.1.0-BETA3
v2.1.0-BETA4
v2.1.0-RC1
v2.1.0-RC2
v2.2.0-BETA1
v2.2.0-BETA2
v2.3.0-BETA1
v2.3.0-BETA2
v2.4.0-BETA1
v2.4.0-BETA2
v2.4.0-RC1
v2.5.0
v2.5.0-BETA1
v2.5.0-BETA2
v2.5.0-RC1
v2.5.1
v2.5.2
v2.6.0-BETA1
v3.*
v3.0.0
v3.0.0-BETA1
v3.1.0
v3.1.0-BETA1
v3.1.0-RC1
v3.1.1
v3.2.0-BETA1
v3.2.0-RC1
v3.3.0-BETA1
v3.3.0-RC1
v4.*
v4.0.0-BETA1
v4.0.0-BETA2
v4.0.0-BETA3
v4.0.0-BETA4
v4.0.0-RC1
v4.1.0-BETA1
v4.2.0
v4.2.0-BETA1
v4.2.0-BETA2
v4.2.0-RC1
v4.3.0-BETA1
v4.3.0-BETA2
v5.*
v5.0.0-BETA1
v5.0.0-BETA2
v5.0.0-RC1
v5.1.0-BETA1
v5.1.0-RC1
v5.2.0
v5.2.0-BETA1
v5.2.0-BETA2
v5.2.0-BETA3
v5.2.0-RC1
v5.2.0-RC2
v5.3.0-BETA1
v5.3.0-BETA2
v5.3.0-BETA3
v5.3.0-BETA4
v5.3.0-RC1
v5.4.0
v5.4.0-BETA1
v5.4.0-BETA2
v5.4.0-BETA3
v5.4.0-RC1
v5.4.1
v5.4.10
v5.4.11
v5.4.12
v5.4.13
v5.4.14
v5.4.15
v5.4.16
v5.4.17
v5.4.18
v5.4.19
v5.4.2
v5.4.20
v5.4.21
v5.4.22
v5.4.23
v5.4.24
v5.4.25
v5.4.26
v5.4.27
v5.4.28
v5.4.29
v5.4.3
v5.4.30
v5.4.31
v5.4.32
v5.4.33
v5.4.34
v5.4.35
v5.4.36
v5.4.37
v5.4.38
v5.4.39
v5.4.4
v5.4.40
v5.4.41
v5.4.42
v5.4.43
v5.4.44
v5.4.45
v5.4.46
v5.4.47
v5.4.48
v5.4.49
v5.4.5
v5.4.50
v5.4.51
v5.4.52
v5.4.6
v5.4.7
v5.4.8
v5.4.9
v6.*
v6.0.0
v6.0.0-BETA1
v6.0.0-BETA2
v6.0.0-BETA3
v6.0.0-RC1
v6.1.0
v6.1.0-BETA1
v6.1.0-BETA2
v6.1.0-RC1
v6.2.0
v6.2.0-BETA1
v6.2.0-BETA2
v6.2.0-BETA3
v6.2.0-RC1
v6.3.0-BETA1
v6.3.0-BETA2
v6.3.0-BETA3
v6.3.0-RC1
v6.4.0
v6.4.0-BETA1
v6.4.0-BETA2
v6.4.0-BETA3
v6.4.0-RC1
v6.4.0-RC2
v6.4.1
v6.4.10
v6.4.11
v6.4.12
v6.4.13
v6.4.14
v6.4.15
v6.4.16
v6.4.17
v6.4.18
v6.4.19
v6.4.2
v6.4.20
v6.4.21
v6.4.22
v6.4.23
v6.4.24
v6.4.25
v6.4.26
v6.4.27
v6.4.28
v6.4.29
v6.4.3
v6.4.30
v6.4.31
v6.4.32
v6.4.33
v6.4.34
v6.4.35
v6.4.36
v6.4.37
v6.4.38
v6.4.39
v6.4.4
v6.4.40
v6.4.5
v6.4.6
v6.4.7
v6.4.8
v6.4.9
v7.*
v7.0.0
v7.0.0-BETA1
v7.0.0-BETA2
v7.0.0-BETA3
v7.0.0-RC1
v7.0.0-RC2
v7.0.1
v7.1.0
v7.1.0-BETA1
v7.1.0-RC1
v7.2.0
v7.2.0-BETA1
v7.2.0-BETA2
v7.2.0-RC1
v7.2.1
v7.3.0
v7.3.0-BETA1
v7.3.0-BETA2
v7.3.0-RC1
v7.4.0
v7.4.0-BETA1
v7.4.0-BETA2
v7.4.0-RC1
v7.4.0-RC2
v7.4.0-RC3
v7.4.1
v7.4.10
v7.4.11
v7.4.12
v7.4.2
v7.4.3
v7.4.4
v7.4.5
v7.4.6
v7.4.7
v7.4.8
v7.4.9
v8.*
v8.0.0
v8.0.1
v8.0.10
v8.0.11
v8.0.12
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.0.8
v8.0.9
Other
vPR3
vPR4
vPR5
vPR6
vPR8
vPR9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48489.json"