Log in Start free

Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-45755Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

Medium 6.9

In plain English

A medium-severity missing authentication in mailtrap-mailer from /mailtrap-mailer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.3%top 81.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:14symfony7.4.12+dfsg-1DEBIAN-CVE-2026-45755
Packagistsymfony/mailtrap-mailer8.0.12GHSA-59f3-vp2f-mp9w
Packagistsymfony/mailtrap-mailer7.4.12GHSA-59f3-vp2f-mp9w
Packagistsymfony/symfony8.0.12GHSA-59f3-vp2f-mp9w
Packagistsymfony/symfony7.4.12GHSA-59f3-vp2f-mp9w
Ubuntu:25.10symfonyno fix listedUBUNTU-CVE-2026-45755
Ubuntu:26.04:LTSsymfonyno fix listedUBUNTU-CVE-2026-45755
Ubuntu:26.10symfonyno fix listedUBUNTU-CVE-2026-45755

Affected products (as reported)

VendorProductVersions
symfony symfony >= 7.2.0, < 7.4.12>= 8.0.0-BETA1, < 8.0.12
/mailtrap-mailer mailtrap-mailer >= 7.2.0, < 7.4.12>= 8.0.0-BETA1, < 8.0.12

Weakness: CWE-306, CWE-347 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References