CVE-2026-48489

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

• CWE-863

• https://github.com/symfony/symfony/commit/c48a4276309e11aedeeb0ce3a89dfbf0b4fe04ffPatch
• https://github.com/symfony/symfony/releases/tag/v5.4.53Product, Release Notes
• https://github.com/symfony/symfony/releases/tag/v6.4.41Product, Release Notes
• https://github.com/symfony/symfony/releases/tag/v7.4.13Product, Release Notes
• https://github.com/symfony/symfony/security/advisories/GHSA-6h46-9jf5-q59xPatch, Vendor Advisory

Published

Jul 14, 2026

Last Modified

Jul 16, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48482GLPI is a free asset and IT management software package. Fro…9.4
• CVE-2026-48483TypeBot is a chatbot builder tool. Prior to version 3.17.0, …5.4
• CVE-2026-48485Quest Bot is an opensource Discord Bot. Prior to version 1.1…2.1
• CVE-2026-48486Signum Node is a HDD-mined cryptocurrency using an energy ef…7.5
• CVE-2026-48487Zeroconf is a pure Python implementation of multicast DNS se…5.3
• CVE-2026-48488phpMyFAQ is an open source FAQ web application. Prior to ver…2.7
• CVE-2026-4849A vulnerability was identified in code-projects Simple Laund…6.1
• CVE-2026-48490ArduinoCore-avr contains the source code and configuration f…6.9
• CVE-2026-48491Traefik is an HTTP reverse proxy and load balancer. From 3.7…10
• CVE-2026-48492Snipe-IT is an IT asset/license management system. Prior to …6.5
• CVE-2026-48493Snipe-IT is an IT asset/license management system. In versio…5.5
• CVE-2026-48494TypeBot is a chatbot builder tool. In version 3.16.1, an aut…7.1