CVE-2026-48489 Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
An attacker can bypass authentication to access protected GET routes by exploiting a subrequest flaw in the default authentication failure handler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48489?
CVE-2026-48489 is a high-severity authentication bypass vulnerability in Sensiolabs Symfony, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.
Weakness: CWE-863
Which versions are affected by CVE-2026-48489?
16 open source packages ship an affected version, including symfony/security-http and symfony/symfony. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/security-http Packagist | All versions | 5.4.53 |
symfony/security-http Packagist | All versions | 5.4.53 |
symfony/security-http Packagist | From 6.0.0 | 6.4.41 |
symfony/security-http Packagist | From 6.0.0 | 6.4.41 |
symfony/security-http Packagist | From 7.0.0 | 7.4.13 |
symfony/security-http Packagist | From 7.0.0 | 7.4.13 |
10 more packages
symfony/security-http Packagist | From 8.0.0 | 8.0.13 |
symfony/security-http Packagist | From 8.0.0 | 8.0.13 |
symfony/symfony Packagist | All versions | 5.4.53 |
symfony/symfony Packagist | All versions | 5.4.53 |
symfony/symfony Packagist | From 6.0.0 | 6.4.41 |
symfony/symfony Packagist | From 6.0.0 | 6.4.41 |
symfony/symfony Packagist | From 7.0.0 | 7.4.13 |
symfony/symfony Packagist | From 7.0.0 | 7.4.13 |
symfony/symfony Packagist | From 8.0.0 | 8.0.13 |
symfony/symfony Packagist | From 8.0.0 | 8.0.13 |
Products include Sensiolabs Symfony.
How do I fix CVE-2026-48489?
Upgrade symfony/security-http to a fixed version for your release line: 5.4.53, 6.4.41, 7.4.13 or 8.0.13.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-48489 being exploited?
There is no known exploitation of CVE-2026-48489 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
Sources
Also known as DEBIAN-CVE-2026-48489, GHSA-6h46-9jf5-q59x, UBUNTU-CVE-2026-48489.