CVE-2026-45755mediumCWE-306CWE-347

CVE-2026-45755: falha de média gravidade em symfony

Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

Publicada em

Seguir esta CVE+ Monitorar symfony+ Monitorar mailtrap-mailer

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
/mailtrap-mailer · mailtrap-mailersymfony · symfony
CVEs relacionadas — symfony

No mesmo produto, das mais perigosas para as menos.

CVE-2024-50340HIGHAbility to change environment from query in symfony/runtimeEPSS 61.8%CVE-2022-24894MEDIUMSymfony storing cookie headers in HttpCacheEPSS 4.0%CVE-2020-15094HIGHRCE in SymfonyEPSS 3.0%CVE-2021-21424MEDIUMPrevent user enumeration using Guard or the new Authenticator-based SecurityEPSS 1.6%CVE-2026-47212MEDIUMSymfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event InjectionEPSS 1.5%CVE-2025-64500HIGHSymfony's incorrect parsing of PATH_INFO can lead to limited authorization bypassEPSS 1.4%