CVE-2026-48489 Sensiolabs CVE debrief

Who should care

Users of Symfony framework versions prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13 should be aware of this vulnerability and take immediate action to protect their applications. This includes reviewing and restricting access to sensitive routes, monitoring for suspicious login attempts, and applying patches or updates as described in the vendor advisory.

Technical summary

A vulnerability in Symfony's DefaultAuthenticationFailureHandler allows an unauthenticated attacker to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners when failure_forward: true was enabled and the _failure_path parameter was supplied in the login request. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. Users of affected versions should update to these versions or apply patches as described in the vendor advisory.

Defensive priority

High priority should be given to updating Symfony to versions 5.4.53, 6.4.41, 7.4.13, or 8.0.13, or applying patches as described in the vendor advisory.

Recommended defensive actions

• Update Symfony to version 5.4.53, 6.4.41, 7.4.13, or 8.0.13
• Apply patches as described in the vendor advisory
• Review and restrict access to sensitive routes
• Monitor for suspicious login attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail provide information on the vulnerability and affected versions. Vendor advisories and patches are available. Evidence limits suggest that further verification is needed to confirm affected scope and severity. Defenders should review official advisories and CVE records to validate affected scope, severity, and vendor guidance.

Official resources