AIKIDO-2026-11065

TL;DR

The symfony/ux-live-component package gated #[LiveAction] invocations on the Accept: application/vnd.live-component+html header as its CSRF protection. That header is CORS-safelisted under the Fetch spec, so a cross-origin fetch() can set it without a preflight, allowing any LiveAction to be forged against a victim's session. Default SameSite=Lax session cookies mitigate the canonical attack, but applications using SameSite=None, permissive cookie policies, or vulnerable to same-origin pivots remained exposed. The fix additionally requires the non-safelisted X-Requested-With: XMLHttpRequest header, forcing a CORS preflight that LiveComponent endpoints do not honor.