CVE-2026-49212
Vulnerability Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier (props vs propsFromParent), or request context, allowing a signed blob minted for one component or slot to be replayed in another and set a read-only prop on a target component. This issue is fixed in versions 2.36.0 and 3.1.0.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-345
Source
NVD
Vendor
symfony
Product
ux
Discussion (0)
Add Comment
No comments yet. Be the first!