AIKIDO-2026-11067

TL;DR

Symfony UX LiveComponent's LiveComponentHydrator::hydrateObjectValue() hydrates #[LiveProp] properties typed as DateTimeInterface with no explicit format by calling new $className($value). PHP's DateTime and DateTimeImmutable constructors accept relative strings such as now, tomorrow, or +10 years, so a client can supply a relative-date payload and push a writable date prop to an arbitrary point in time, bypassing components that gate time-based business logic on that prop. The fix parses format-less date props strictly with createFromFormat(DateTimeInterface::RFC3339, ...), matching the format emitted by dehydrateObjectValue() so only valid RFC 3339 inputs are accepted.