Symfony UX is a JavaScript ecosystem for Symfony that includes the LiveComponent module. In versions 2.8.0 through 2.36.0 and 3.1.0, the HMAC generated by Symfony\\UX\\LiveComponent\\LiveComponentHydrator incorporated only the sorted prop key/value pairs and omitted the component name, the slot identifier (props vs propsFromParent), and the request context. This omission allows an attacker to reuse a signed blob created for one component or slot in another component or slot, thereby altering a read‑only prop on the target component. The flaw is classified as CWE‑345: Broken Authentication.

The vulnerability affects Symfony UX LiveComponent versions ranging from 2.8.0 through 2.36.0 and 3.1.0. Users employing these releases in any environment where LiveComponentHydrator is used are potentially impacted until a version that includes the fix is deployed. The affected product is the symfony:ux package in Symfony projects.

The CVSS score of 6.9 indicates a medium severity condition. The EPSS score of <1% suggests that exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog, so there is no evidence of widespread, active exploitation. However, the vulnerability is a replay attack that could be leveraged by an attacker with knowledge of a signed blob to set read‑only props, potentially altering component state or enabling further privilege escalation if the component performs actions based on those props. The attack requires the attacker to possess a valid signed blob for one component and to find a target component that shares compatible props, which may limit its applicability but does not negate the risk entirely. Managers should monitor for any signs of custom exploit development, but immediate patching will remove the vector before such activity occurs.