p PatchFirst

CVE-2026-45755

CVE-2026-45755 · Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.

CVSS 6.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • symfony

    Versions
    • >= 7.2.0, < 7.4.12: Affected
    • >= 8.0.0-BETA1, < 8.0.12: Affected

    No fix published

  • mailtrap-mailer

    Versions
    • >= 7.2.0, < 7.4.12: Affected
    • >= 8.0.0-BETA1, < 8.0.12: Affected

    No fix published

  • symfony Debian:14

    Versions
    • 6.4.21+dfsg-2
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 7.4.12+dfsg-1

    Update to 7.4.12+dfsg-1

  • symfony/mailtrap-mailer Packagist

    Versions
    • v7.2.0
    • v7.3.0
    • v7.3.0-BETA1
    • v7.3.0-RC1
    • v7.4.0
    • v7.4.0-BETA1
    • v7.4.0-RC1
    Affected ranges
    • ECOSYSTEM: ≥ 7.2.0, < 7.4.12

    Update to 7.4.12

  • symfony/mailtrap-mailer Packagist

    Versions
    • v8.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.0.12

    Update to 8.0.12

  • symfony/symfony Packagist

    Versions
    • v7.2.0
    • v7.2.1
    • v7.2.2
    • v7.2.3
    • v7.2.4
    • v7.2.5
    • v7.2.6
    • v7.2.7
    • v7.2.8
    • v7.2.9
    • v7.3.0
    • v7.3.0-BETA1
    • v7.3.0-BETA2
    • v7.3.0-RC1
    • v7.3.1
    • v7.3.10
    • v7.3.11
    • v7.3.2
    • v7.3.3
    • v7.3.4
    • v7.3.5
    • v7.3.6
    • v7.3.7
    • v7.3.8
    • v7.3.9
    • v7.4.0
    • v7.4.0-BETA1
    • v7.4.0-BETA2
    • v7.4.0-RC1
    • v7.4.0-RC2
    • v7.4.0-RC3
    • v7.4.1
    • v7.4.10
    • v7.4.11
    • v7.4.2
    • v7.4.3
    • v7.4.4
    • v7.4.5
    • v7.4.6
    • v7.4.7
    • v7.4.8
    • v7.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 7.2.0, < 7.4.12

    Update to 7.4.12

  • symfony/symfony Packagist

    Versions
    • v8.0.0
    • v8.0.1
    • v8.0.10
    • v8.0.11
    • v8.0.2
    • v8.0.3
    • v8.0.4
    • v8.0.5
    • v8.0.6
    • v8.0.7
    • v8.0.8
    • v8.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.0.12

    Update to 8.0.12

  • symfony Ubuntu:16.04:LTS

    Versions
    • 2.7.1+dfsg-1
    • 2.7.5+dfsg-1
    • 2.7.9+dfsg-1
    • 2.7.9+dfsg-1ubuntu2
    • 2.7.10-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:18.04:LTS

    Versions
    • 2.8.7+dfsg-1.3ubuntu1
    • 3.4.3+dfsg-1ubuntu4
    • 3.4.6+dfsg-1
    • 3.4.6+dfsg-1ubuntu0.1
    • 3.4.6+dfsg-1ubuntu0.1+esm1
    • 3.4.6+dfsg-1ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:20.04:LTS

    Versions
    • 4.3.4+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1+esm1
    • 4.3.8+dfsg-1ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:22.04:LTS

    Versions
    • 5.2.6+dfsg-1ubuntu7
    • 5.4.4+dfsg-1ubuntu8
    • 5.4.4+dfsg-1ubuntu8+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:24.04:LTS

    Versions
    • 5.4.23+dfsg-1ubuntu1
    • 5.4.35+dfsg-3ubuntu1
    • 6.4.5+dfsg-3ubuntu2
    • 6.4.5+dfsg-3ubuntu3
    • 6.4.5+dfsg-3ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:25.10

    Versions
    • 6.4.18+dfsg-1ubuntu1
    • 6.4.21+dfsg-2
    • 6.4.21+dfsg-2ubuntu1
    • 6.4.24+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.10

    Versions
    • 7.4.7+dfsg-1ubuntu1
    • 7.4.9+dfsg-1ubuntu1
    • 7.4.13+dfsg-2ubuntu1
    • 7.4.14+dfsg-1ubuntu2
    • 7.4.15+dfsg-2ubuntu2
    • 7.4.16+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.04:LTS

    Versions
    • 6.4.24+dfsg-1
    • 7.4.5+dfsg-1ubuntu1
    • 7.4.6+dfsg-2ubuntu1
    • 7.4.7+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →