p PatchFirst

CVE-2026-47212

CVE-2026-47212 · Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inject forged Twilio status payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CVSS 6.9 · Medium · EPSS 1.5% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • symfony

    Versions
    • >= 6.4.0, < 6.4.40: Affected
    • >= 7.0.0-BETA1, < 7.4.12: Affected
    • >= 8.0.0-BETA1, < 8.0.12: Affected

    No fix published

  • twilio-notifier

    Versions
    • >= 6.4.0, < 6.4.40: Affected
    • >= 7.0.0-BETA1, < 7.4.12: Affected
    • >= 8.0.0-BETA1, < 8.0.12: Affected

    No fix published

  • symfony Debian:13

    Versions
    • 6.4.21+dfsg-2
    • 6.4.21+dfsg-2+deb13u1
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 6.4.40+dfsg-0+deb13u1
    Affected ranges
    • ECOSYSTEM: < 6.4.41+dfsg-0+deb13u1

    Update to 6.4.41+dfsg-0+deb13u1

  • symfony Debian:14

    Versions
    • 6.4.21+dfsg-2
    • 6.4.24+dfsg-1
    • 6.4.25+dfsg-1
    • 7.0.4+dfsg-1
    • 7.0.5+dfsg-1
    • 7.0.6+dfsg-1
    • 7.0.7+dfsg-1
    • 7.1.0~beta1+dfsg-1
    • 7.1.0~rc1+dfsg-1
    • 7.1.2+dfsg-1
    • 7.1.3+dfsg-1
    • 7.1.4+dfsg-1
    • 7.1.5+dfsg-1
    • 7.2.0~beta1+dfsg-1
    • 7.2.0~beta2+dfsg-1
    • 7.2.0~rc1+dfsg-1
    • 7.2.1+dfsg-1
    • 7.2.2+dfsg-1
    • 7.2.3+dfsg-1
    • 7.2.4+dfsg-1
    • 7.2.5+dfsg-1
    • 7.2.6-1
    • 7.3.0+dfsg-1
    • 7.3.0~beta1+dfsg-1
    • 7.3.0~beta2+dfsg-1
    • 7.3.0~rc1+dfsg-1
    • 7.3.1+dfsg-1
    • 7.3.2+dfsg-1
    • 7.3.3+dfsg-1
    • 7.3.4+dfsg-1
    • 7.3.5-1
    • 7.4.0+dfsg-1
    • 7.4.0+dfsg-2
    • 7.4.0~beta1-1
    • 7.4.0~beta1-2
    • 7.4.0~beta2+dfsg-1
    • 7.4.0~beta2+dfsg-2
    • 7.4.0~beta2+dfsg-3
    • 7.4.0~rc1+dfsg-1
    • 7.4.0~rc2+dfsg-1
    • 7.4.0~rc3+dfsg-1
    • 7.4.10+dfsg-1
    • 7.4.2+dfsg-1
    • 7.4.2+dfsg-2
    • 7.4.3+dfsg-1
    • 7.4.4+dfsg-1
    • 7.4.5+dfsg-1
    • 7.4.6+dfsg-1
    • 7.4.6+dfsg-2
    • 7.4.7+dfsg-1
    • 7.4.8+dfsg-1
    • 7.4.9+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 7.4.12+dfsg-1

    Update to 7.4.12+dfsg-1

  • symfony/symfony Packagist

    Versions
    • v6.4.0
    • v6.4.1
    • v6.4.10
    • v6.4.11
    • v6.4.12
    • v6.4.13
    • v6.4.14
    • v6.4.15
    • v6.4.16
    • v6.4.17
    • v6.4.18
    • v6.4.19
    • v6.4.2
    • v6.4.20
    • v6.4.21
    • v6.4.22
    • v6.4.23
    • v6.4.24
    • v6.4.25
    • v6.4.26
    • v6.4.27
    • v6.4.28
    • v6.4.29
    • v6.4.3
    • v6.4.30
    • v6.4.31
    • v6.4.32
    • v6.4.33
    • v6.4.34
    • v6.4.35
    • v6.4.36
    • v6.4.37
    • v6.4.38
    • v6.4.39
    • v6.4.4
    • v6.4.5
    • v6.4.6
    • v6.4.7
    • v6.4.8
    • v6.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 6.4.0, < 6.4.40

    Update to 6.4.40

  • symfony/symfony Packagist

    Versions
    • v7.0.0
    • v7.0.1
    • v7.0.10
    • v7.0.2
    • v7.0.3
    • v7.0.4
    • v7.0.5
    • v7.0.6
    • v7.0.7
    • v7.0.8
    • v7.0.9
    • v7.1.0
    • v7.1.0-BETA1
    • v7.1.0-RC1
    • v7.1.1
    • v7.1.10
    • v7.1.11
    • v7.1.2
    • v7.1.3
    • v7.1.4
    • v7.1.5
    • v7.1.6
    • v7.1.7
    • v7.1.8
    • v7.1.9
    • v7.2.0
    • v7.2.0-BETA1
    • v7.2.0-BETA2
    • v7.2.0-RC1
    • v7.2.1
    • v7.2.2
    • v7.2.3
    • v7.2.4
    • v7.2.5
    • v7.2.6
    • v7.2.7
    • v7.2.8
    • v7.2.9
    • v7.3.0
    • v7.3.0-BETA1
    • v7.3.0-BETA2
    • v7.3.0-RC1
    • v7.3.1
    • v7.3.10
    • v7.3.11
    • v7.3.2
    • v7.3.3
    • v7.3.4
    • v7.3.5
    • v7.3.6
    • v7.3.7
    • v7.3.8
    • v7.3.9
    • v7.4.0
    • v7.4.0-BETA1
    • v7.4.0-BETA2
    • v7.4.0-RC1
    • v7.4.0-RC2
    • v7.4.0-RC3
    • v7.4.1
    • v7.4.10
    • v7.4.11
    • v7.4.2
    • v7.4.3
    • v7.4.4
    • v7.4.5
    • v7.4.6
    • v7.4.7
    • v7.4.8
    • v7.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 7.0.0, < 7.4.12

    Update to 7.4.12

  • symfony/symfony Packagist

    Versions
    • v8.0.0
    • v8.0.1
    • v8.0.10
    • v8.0.11
    • v8.0.2
    • v8.0.3
    • v8.0.4
    • v8.0.5
    • v8.0.6
    • v8.0.7
    • v8.0.8
    • v8.0.9
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.0.12

    Update to 8.0.12

  • symfony/twilio-notifier Packagist

    Versions
    • v6.4.0
    • v6.4.13
    • v6.4.24
    • v6.4.3
    • v6.4.32
    • v6.4.7
    • v6.4.8
    Affected ranges
    • ECOSYSTEM: ≥ 6.4.0, < 6.4.40

    Update to 6.4.40

  • symfony/twilio-notifier Packagist

    Versions
    • v7.0.0
    • v7.0.3
    • v7.0.7
    • v7.0.8
    • v7.1.0
    • v7.1.0-BETA1
    • v7.1.0-RC1
    • v7.1.1
    • v7.1.6
    • v7.2.0
    • v7.2.0-BETA1
    • v7.2.0-RC1
    • v7.3.0
    • v7.3.0-BETA1
    • v7.3.0-RC1
    • v7.3.10
    • v7.4.0
    • v7.4.0-BETA1
    • v7.4.0-RC1
    • v7.4.4
    Affected ranges
    • ECOSYSTEM: ≥ 7.0.0, < 7.4.12

    Update to 7.4.12

  • symfony/twilio-notifier Packagist

    Versions
    • v8.0.0
    • v8.0.4
    Affected ranges
    • ECOSYSTEM: ≥ 8.0.0, < 8.0.12

    Update to 8.0.12

  • symfony Ubuntu:16.04:LTS

    Versions
    • 2.7.1+dfsg-1
    • 2.7.5+dfsg-1
    • 2.7.9+dfsg-1
    • 2.7.9+dfsg-1ubuntu2
    • 2.7.10-0ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:18.04:LTS

    Versions
    • 2.8.7+dfsg-1.3ubuntu1
    • 3.4.3+dfsg-1ubuntu4
    • 3.4.6+dfsg-1
    • 3.4.6+dfsg-1ubuntu0.1
    • 3.4.6+dfsg-1ubuntu0.1+esm1
    • 3.4.6+dfsg-1ubuntu0.1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:20.04:LTS

    Versions
    • 4.3.4+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1
    • 4.3.8+dfsg-1ubuntu1+esm1
    • 4.3.8+dfsg-1ubuntu1+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:22.04:LTS

    Versions
    • 5.2.6+dfsg-1ubuntu7
    • 5.4.4+dfsg-1ubuntu8
    • 5.4.4+dfsg-1ubuntu8+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:Pro:24.04:LTS

    Versions
    • 5.4.23+dfsg-1ubuntu1
    • 5.4.35+dfsg-3ubuntu1
    • 6.4.5+dfsg-3ubuntu2
    • 6.4.5+dfsg-3ubuntu3
    • 6.4.5+dfsg-3ubuntu3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:25.10

    Versions
    • 6.4.18+dfsg-1ubuntu1
    • 6.4.21+dfsg-2
    • 6.4.21+dfsg-2ubuntu1
    • 6.4.24+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.10

    Versions
    • 7.4.7+dfsg-1ubuntu1
    • 7.4.9+dfsg-1ubuntu1
    • 7.4.13+dfsg-2ubuntu1
    • 7.4.14+dfsg-1ubuntu2
    • 7.4.15+dfsg-2ubuntu2
    • 7.4.16+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • symfony Ubuntu:26.04:LTS

    Versions
    • 6.4.24+dfsg-1
    • 7.4.5+dfsg-1ubuntu1
    • 7.4.6+dfsg-2ubuntu1
    • 7.4.7+dfsg-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →