Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M
CVE-2026-45754Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
Medium 6.9
In plain English
A medium-severity improper authentication in lox24-notifier from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | symfony | 6.4.41+dfsg-0+deb13u1 | DEBIAN-CVE-2026-45754 |
| Debian:14 | symfony | 7.4.12+dfsg-1 | DEBIAN-CVE-2026-45754 |
| Packagist | symfony/lox24-notifier | 7.4.12 | GHSA-64hg-93w9-fc35 |
| Packagist | symfony/lox24-notifier | 8.0.12 | GHSA-64hg-93w9-fc35 |
| Packagist | symfony/mailjet-mailer | 8.0.12 | GHSA-64hg-93w9-fc35 |
| Packagist | symfony/mailjet-mailer | 6.4.40 | GHSA-64hg-93w9-fc35 |
| Packagist | symfony/mailjet-mailer | 7.4.12 | GHSA-64hg-93w9-fc35 |
| Packagist | symfony/symfony | 7.4.12 | GHSA-64hg-93w9-fc35 |
| Packagist | symfony/symfony | 6.4.40 | GHSA-64hg-93w9-fc35 |
| Packagist | symfony/symfony | 8.0.12 | GHSA-64hg-93w9-fc35 |
| Ubuntu:25.10 | symfony | no fix listed | UBUNTU-CVE-2026-45754 |
| Ubuntu:26.04:LTS | symfony | no fix listed | UBUNTU-CVE-2026-45754 |
| Ubuntu:26.10 | symfony | no fix listed | UBUNTU-CVE-2026-45754 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| symfony | symfony | >= 6.4.0, < 6.4.40>= 7.0.0-BETA1, < 7.4.12>= 8.0.0-BETA1, < 8.0.12 |
| symfony | lox24-notifier | >= 7.1.0-BETA1, < 7.4.12>= 8.0.0-BETA1, < 8.0.12 |
| symfony | mailjet-mailer | >= 6.4.0, < 6.4.40>= 7.0.0-BETA1, < 7.4.12>= 8.0.0-BETA1, < 8.0.12 |
Weakness: CWE-287, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35 x_refsource_CONFIRM
- https://github.com/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838e x_refsource_MISC
- https://github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77 x_refsource_MISC
- https://github.com/symfony/symfony/releases/tag/v6.4.40 x_refsource_MISC
- https://github.com/symfony/symfony/releases/tag/v7.4.12 x_refsource_MISC
- https://github.com/symfony/symfony/releases/tag/v8.0.12 x_refsource_MISC