CVE-2026-48747

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

State: Published
Severity: 6.3 Medium
Published: Jul 14, 2026
Updated: Jul 15, 2026
Reserved: May 22, 2026

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-347 Improper Verification of Cryptographic Signature
CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Affected Products

Product	Versions
symfonysymfony	>= 7.2.0, < 7.4.12Affected >= 8.0.0-BETA1, < 8.0.13Affected
mailomat-mailersymfony	>= 7.2.0, < 7.4.12Affected >= 8.0.0-BETA1, < 8.0.13Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.