CVE-2026-45754

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Symfony Mailer Bridges

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45754

EUVD

EUVD-2026-44360

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 6.4.0 (inc) to 6.4.40 (exc)
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Symfony's Mailjet mailer bridge and LOX24 notifier bridge webhook parsers. These parsers did not verify configured webhook secrets, allowing unauthenticated POST requests to inject forged event payloads. The issue was fixed in versions 6.4.40, 7.4.12, and 8.0.12 by adding validation for webhook secrets.

Detection Guidance

Check Symfony versions for affected packages (symfony/lox24-notifier, symfony/mailjet-mailer, symfony/symfony) using commands like 'composer show symfony/mailjet-mailer' or 'php bin/console --version'. Inspect webhook endpoints for Mailjet and LOX24 integrations to verify if secrets are configured but not enforced.

Impact Analysis

Attackers could exploit this to send forged Mailjet or LOX24 event payloads to your webhook endpoints. This may lead to corruption of suppression lists, fraudulent delivery metrics, or other malicious activities depending on how the webhooks are used in your application.

Compliance Impact

This vulnerability could lead to unauthorized data changes, potentially violating integrity requirements in GDPR or HIPAA. If webhook events are used to process sensitive data, the lack of authentication may result in non-compliance with data integrity and security controls required by these regulations.

Mitigation Strategies

Upgrade Symfony to patched versions (6.4.40, 7.4.12, or 8.0.12) immediately. For Mailjet, ensure Basic auth is enforced by checking Authorization headers. For LOX24, validate X-LOX24-Token headers against configured secrets using constant-time comparison.

Hi! I’m here to help you understand CVE-2026-45754. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70