A flaw in Symfony UX LiveComponent event handling permits attackers to forge cross‑origin #[LiveAction] requests by manipulating the Accept header. The listener only accepts the value application/vnd.live-component+html, but that value is CORS‑safelisted, enabling a malicious site to set it through a cross‑origin fetch without a preflight request. When the application is configured to send session cookies with SameSite=None, credentials: 'include', or uses a permissive cookie policy, the forged request can be executed against a victim session. This is a classic CSRF bypass (CWE‑352) that allows an attacker to perform actions on behalf of the victim using their authenticated session.

The issue affects Symfony applications that include the symfony/ux package in versions from 2.22.0 up to but not including 2.36.0, and also version 3.1.0 before its release. The vendor is Symfony, and the product is Symfony UX LiveComponent. All applications using these versions and relying on SameSite=None or a permissive cookie setting are susceptible; versions 2.36.0, 3.1.0, and later contain the fix.

The CVSS score is 2.1, indicating low overall severity, and the EPSS score is less than 1%, suggesting that exploitation is currently unlikely. The vulnerability is not listed in CISA KEV, reinforcing its low visibility to public exploitation. However, if an attacker can control the Accept header in a cross‑origin fetch and the application is configured to send credentials to that origin, the bypass can be enacted with minimal setup. The primary attack vector is therefore a same‑origin or cross‑origin web application that relies on the default CSRF protections of Symfony UX LiveComponents.