CVE-2026-45754
published 2026-07-14CVE-2026-45754: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer…
PriorityP333medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.35%
27.1th percentile
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sensiolabs | symfony | >= 6.4.0 < 6.4.40 | 6.4.40 |
| sensiolabs | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| sensiolabs | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | lox24-notifier | — | — |
| symfony | lox24-notifier | — | — |
| symfony | lox24-notifier | >= 7.1.0 < 7.4.12 | 7.4.12 |
| symfony | lox24-notifier | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | mailjet-mailer | — | — |
| symfony | mailjet-mailer | — | — |
| symfony | mailjet-mailer | — | — |
| symfony | mailjet-mailer | >= 6.4.0 < 6.4.40 | 6.4.40 |
| symfony | mailjet-mailer | >= 7.0.0 < 7.4.12 | 7.4.12 |
| symfony | mailjet-mailer | >= 8.0.0 < 8.0.12 | 8.0.12 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 6.4.0 < 6.4.40 | 6.4.40 |
| symfony | symfony | >= 7.0.0 < 7.4.12 | 7.4.12 |
| symfony | symfony | >= 8.0.0 < 8.0.12 | 8.0.12 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Symfony Mailjet Mailer Webhook Parser injection
vuldb·2026-05-28
CVE-2026-45754 [CRITICAL] Symfony Mailjet Mailer Webhook Parser injection
A vulnerability has been found in Symfony Mailjet Mailer and classified as critical. The impacted element is an unknown function of the component Webhook Parser. This manipulation causes injection.
This vulnerability is handled as CVE-2026-45754. The attack can be initiated remotely. There is not any exploit available.
The affected component should be upgraded.
GHSA
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
ghsa·2026-05-28
CVE-2026-45754 [MEDIUM] CWE-287 Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
### Description
The Mailjet mailer bridge and the LOX24 SMS notifier bridge both ship webhook request parsers used to authenticate and decode the event callbacks each provider POSTs to an application's webhook endpoint. Their `doParse(Request $request, #[\SensitiveParameter] string $secret)` methods receive the configured webhook secret but never read it; they convert and return the payload unconditionally.
As a result, an application that wires up either webhook endpoint accepts **any** POST to that URL, even when a webhook secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged event payloads, fake bounce / blocked / s
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838ehttps://github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77https://github.com/symfony/symfony/releases/tag/v6.4.40https://github.com/symfony/symfony/releases/tag/v7.4.12https://github.com/symfony/symfony/releases/tag/v8.0.12https://github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35
2026-07-14
Published