CVE-2026-45755

Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

State: Published
Severity: 6.9 Medium
Published: Jul 14, 2026
Updated: Jul 14, 2026
Reserved: May 13, 2026

Read the record on cve.org

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-347 Improper Verification of Cryptographic Signature

Affected Products

Product	Versions
symfonysymfony	>= 7.2.0, < 7.4.12Affected >= 8.0.0-BETA1, < 8.0.12Affected
mailtrap-mailer/mailtrap-mailer	>= 7.2.0, < 7.4.12Affected >= 8.0.0-BETA1, < 8.0.12Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.