# Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

Symfony's failure_forward subrequest honors attacker-supplied _failure_path, letting unauthenticated users read access_control-protected GET routes outside the firewall.

- Payout: Research
- Severity: high
- Program: Symfony
- Found by: a-tt-om, teebow1e
- Disclosed: 2026-06-15
- CVE: CVE-2026-48489
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-6h46-9jf5-q59x
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-6h46-9jf5-q59x
- Tags: area:web domain:web impact:data-leak impact:internal-access kind:research platform:ghsa sev:high tech:php technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Symfony security-http firewall / DefaultAuthenticationFailureHandler
**Root cause:** DefaultAuthenticationFailureHandler uses the request-supplied _failure_path as the target of an internal SUB_REQUEST, and Firewall::onKernelRequest skips subrequests, so AccessListener never evaluates access_control for the attacker-chosen path.
**Steps:**
1. Configure a firewall with form-login and `failure_forward: true`.
2. Send an unauthenticated POST to the check path with `_failure_path=/admin/whatever`.
3. Authentication fails; handler dispatches a SUB_REQUEST to the attacker-chosen path.
4. Firewall skips the subrequest, AccessListener does not run, target controller executes and its response is returned.
**Exploitation:** Unauthenticated attacker posts to the login check path with a crafted `_failure_path` pointing at any access_control-protected GET route (e.g. /admin data export); the internal subrequest bypasses the firewall and the protected response is returned to the attacker.
**Insight:** When a framework skips security listeners for subrequests assuming they're trusted, hunt for any request-controlled parameter that becomes a subrequest path — here the login failure forward target.