Sign in
Deutsch English Español Polski
Medium

Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

  • Disclosed: 28.05.2026
  • Updated: 11.10.2026 10:22

Description

The Mailtrap mailer bridge ships a webhook request parser used to authenticate and decode the event callbacks Mailtrap POSTs to an application's webhook endpoint. Its doParse(Request $request, #[\SensitiveParameter] string $secret) method receives the configured webhook secret but never reads it; it decodes and returns the payload unconditionally, ignoring the X-Mt-Signature HMAC header Mailtrap sends with each request.

As a result, an application that wires up the Mailtrap webhook endpoint accepts any POST to that URL, even when a signing secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged event payloads, fake delivery / bounce / open / click / spam events, leading to suppression-list corruption, delivery-metrics fraud, etc.

Resolution

MailtrapRequestParser::doParse() now requires and verifies the X-Mt-Signature header, an HMAC-SHA256 of the raw request body keyed with the configured secret, before decoding the payload, using a constant-time comparison.

When no secret is configured the behaviour is unchanged: signature verification remains opt-in, but it is now actually enforced once opted in.

The patch for this issue is available here for branch 7.4.

Credits

Symfony would like to thank Himanshu Anand for reporting the issue and Alexandre Daubois providing the fix.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package symfony/mailtrap-mailer >= 7.2.0, < 7.4.12, >= 8.0.0, < 8.0.12 7.4.12, 8.0.12
Composer package symfony/symfony >= 7.2.0, < 7.4.12, >= 8.0.0, < 8.0.12 7.4.12, 8.0.12

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Weakness (CWE)
CWE-306, CWE-347
Platform
Composer
Package
symfony/mailtrap-mailer, symfony/symfony
Disclosed
28.05.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-59f3-vp2f-mp9w - CC BY 4.0

Vulnerability history: symfony/symfony

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (100) in the archive
Total entries
100
First → latest
11.2019 06.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 28
  • Medium 51
  • Low 13

Disclosures per year

Severity:
  1. Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
    High CVE-2026-48489 < 5.4.53, >= 6.0.0, < 6.4.41, >= 7.0.0, < 7.4.13, >= 8.0.0, < 8.0.13 5.4.53, 6.4.41, 7.4.13, 8.0.13
  2. Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection this entry
    Medium CVE-2026-45755 >= 7.2.0, < 7.4.12, >= 8.0.0, < 8.0.12 7.4.12, 8.0.12
  3. Symfony has Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
    High CVE-2026-45077 < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  4. Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
    High CVE-2026-45075 >= 7.4.0, < 7.4.12, >= 8.0.0, < 8.0.12 7.4.12, 8.0.12
  5. Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address
    High CVE-2026-45067 < 5.4.52, >= 6.0.0, < 6.4.40, >= 7.0.0, < 7.4.12, >= 8.0.0, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  6. Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator
    High CVE-2026-45063 < 5.4.52, >= 6.0.0-BETA1, < 6.4.40, >= 7.0.0-BETA1, < 7.4.12, >= 8.0.0-BETA1, < 8.0.12 5.4.52, 6.4.40, 7.4.12, 8.0.12
  7. Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass
    High · 7.3 CVE-2025-64500 >= 2.0.0, < 5.4.50, >= 6.0.0, < 6.4.29, >= 7.0.0, < 7.3.7 5.4.50, 6.4.29, 7.3.7
  8. Symfony vulnerable to command execution hijack on Windows with Process class
    High · 8.4 CVE-2024-51736 < 5.4.46, >= 6.0.0, < 6.4.14, >= 7.0.0, < 7.1.7 5.4.46, 6.4.14, 7.1.7
  9. Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
    High · 8.1 CVE-2014-6072 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  10. Symfony XML Entity Expansion security vulnerability
    High · 7.5 ghsa-q2gc-gg3x-7942 >= 2.0.0, < 2.0.17 2.0.17
  11. Symfony XML decoding attack vector through external entities
    Critical · 9.8 ghsa-mmcv-fvq8-r9x3 >= 2.0.0, < 2.0.11 2.0.11
  12. Symfony allows direct access of ESI URLs behind a trusted proxy
    High · 7.5 CVE-2014-5245 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  13. Symfony vulnerable to denial of service via a malicious HTTP Host header
    High · 7.5 CVE-2014-5244 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  14. Code injection in the way Symfony implements translation caching in FrameworkBundle
    High · 7.5 CVE-2014-4931 >= 2.0.0, < 2.3.19, >= 2.4.0, < 2.4.9, >= 2.5.0, < 2.5.4 2.3.19, 2.4.9, 2.5.4
  15. Symfony Incorrect Access Control
    Critical · 9.8 CVE-2017-11365 >= 2.7.30, < 2.7.32, >= 2.8.23, < 2.8.25, >= 3.2.10, < 3.2.12, >= 3.3.3, < 3.3.5 2.7.32, 2.8.25, 3.2.12, 3.3.5
  16. Symphony Denial of Service Via Overlong Usernames
    High · 7.5 CVE-2016-4423 >= 2.3.0, < 2.3.41, >= 2.4.0, < 2.7.13, >= 2.8.0, < 2.8.6, >= 3.0.0, < 3.0.6 2.3.41, 2.7.13, 2.8.6, 3.0.6
  17. Symfony Cryptographic Vulnerability
    High · 7.5 CVE-2016-1902 >= 2.3.0, < 2.3.37, >= 2.4.0, < 2.6.13, >= 2.7.0, < 2.7.9 2.3.37, 2.6.13, 2.7.9
  18. Symfony Vulnerable to Timing Attack
    High CVE-2015-8125 >= 2.3.0, < 2.3.35, >= 2.7.0, < 2.7.7, >= 2.4.0, < 2.6.12 2.3.35, 2.7.7, 2.6.12
  19. Symphony Vulnerable to PHP Code Injection via YAML Parsing
    High CVE-2013-1348 >= 2.0.0, < 2.0.22 2.0.22
  20. Symfony Arbitrary PHP code Execution
    High CVE-2013-1397 >= 2.2.0-BETA1, < 2.2.0-BETA2, >= 2.0.0, < 2.0.22, >= 2.1.0, < 2.1.7 2.2.0-BETA2, 2.0.22, 2.1.7
  21. Symfony Authentication Bypass
    Critical · 9.8 CVE-2018-11407 >= 2.8.0, < 2.8.37, >= 3.0.0, < 3.3.17, >= 3.4.0, < 3.4.7, >= 4.0.0, < 4.0.7 2.8.37, 3.3.17, 3.4.7, 4.0.7
  22. Symfony Authentication Bypass
    Critical · 9.8 CVE-2016-2403 >= 2.8.0, < 2.8.6, >= 3.0.0, < 3.0.6 2.8.6, 3.0.6
  23. Symfony Host Header Injection
    High · 7.2 CVE-2018-14774 >= 2.7.0, < 2.7.49, >= 2.8.0, < 2.8.44, >= 3.3.0, < 3.3.18, >= 3.4.0, < 3.4.14, >= 4.0.0, < 4.0.14, >= 4.1.0, < 4.1.3 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.3
  24. Symfony Session Fixation Vulnerability
    High · 8.1 CVE-2018-11385 >= 2.7.0, < 2.7.48, >= 2.8.0, < 2.8.41, >= 3.0.0, < 3.3.17, >= 3.4.0, < 3.4.11, >= 4.0.0, < 4.0.11 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
  25. Symfony Directory Traversal
    High · 7.5 CVE-2017-16654 >= 2.7.0, < 2.7.38, >= 2.8.0, < 2.8.31, >= 3.0.0, < 3.2.14, >= 3.3.0, < 3.3.13 2.7.38, 2.8.31, 3.2.14, 3.3.13
  26. Symfony CSRF Token Fixation
    High · 8.8 CVE-2018-11406 >= 2.7.0, < 2.7.48, >= 2.8.0, < 2.8.41, >= 3.0.0, < 3.3.17, >= 3.4.0, < 3.4.11, >= 4.0.0, < 4.0.11 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
  27. Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
    High · 8.1 CVE-2013-4751 >= 2.0.0, < 2.0.24, >= 2.1.0, < 2.1.12, >= 2.2.0, < 2.2.5, >= 2.3.0, < 2.3.3 2.0.24, 2.1.12, 2.2.5, 2.3.3
  28. Symfony Http-Kernel has non-constant time comparison in UriSigner
    High · 8.1 CVE-2019-18887 >= 2.2.0, < 2.8.52, >= 3.0.0, < 3.4.35, >= 4.0.0, < 4.2.12, >= 4.3.0, < 4.3.8 2.8.52, 3.4.35, 4.2.12, 4.3.8
  29. RCE in Symfony
    High · 8.0 CVE-2020-15094 >= 4.3.0, < 4.4.13, >= 5.0.0, < 5.1.5 4.4.13, 5.1.5
  30. Firewall configured with unanimous strategy was not actually unanimous in Symfony
    High · 7.6 CVE-2020-5275 >= 4.4.0, < 4.4.7, >= 5.0.0, < 5.0.7 4.4.7, 5.0.7
  31. Improper authentication in Symfony
    High · 7.5 CVE-2019-10911 >= 2.7.0, < 2.7.51, >= 2.8.0, < 2.8.50, >= 3.0.0, < 3.4.26, >= 4.0.0, < 4.1.12, >= 4.2.0, < 4.2.7 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7
  32. Deserialization of untrusted data in Symfony
    High · 7.1 CVE-2019-10912 >= 2.8.0, < 2.8.50, >= 3.0.0, < 3.4.26, >= 4.0.0, < 4.1.12, >= 4.2.0, < 4.2.7 2.8.50, 3.4.26, 4.1.12, 4.2.7
  33. Improper Input Validation in Symfony
    Critical · 9.8 CVE-2019-11325 >= 4.2.0, < 4.2.12, >= 4.3.0, < 4.3.8 4.2.12, 4.3.8
  34. Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
    Critical · 9.8 CVE-2019-10913 >= 2.7.0, < 2.7.51, >= 2.8.0, < 2.8.50, >= 3.0.0, < 3.4.26, >= 4.0.0, < 4.1.12, >= 4.2.0, < 4.2.7 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7
  35. Argument injection in a MimeTypeGuesser in Symfony
    High · 7.5 CVE-2019-18888 >= 2.0.0, < 2.8.52, >= 3.0.0, < 3.4.35, >= 4.0.0, < 4.2.12, >= 4.3.0, < 4.3.8 2.8.52, 3.4.35, 4.2.12, 4.3.8
  36. Symfony Unsafe Cache Serialization Could Enable RCE
    Critical · 9.8 CVE-2019-18889 >= 3.1.0, < 3.4.35, >= 4.0.0, < 4.2.12, >= 4.3.0, < 4.3.8 3.4.35, 4.2.12, 4.3.8
  37. Symfony Service IDs Allow Injection
    Critical · 9.8 CVE-2019-10910 >= 2.7.0, < 2.7.51, >= 2.8.0, < 2.8.50, >= 3.0.0, < 3.4.26, >= 4.0.0, < 4.1.12, >= 4.2.0, < 4.2.7 2.7.51, 2.8.50, 3.4.26, 4.1.12, 4.2.7

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.