CVE-2026-45755

Analyzed Analyzed - Analysis Complete

Mailtrap Webhook Secret Bypass in Symfony

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-45755

EUVD

EUVD-2026-44361

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)
sensiolabs	symfony	From 7.2.0 (inc) to 7.4.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects Symfony's Mailtrap Mailer Webhook Parser. The MailtrapRequestParser::doParse() function receives a configured webhook secret but ignores the X-Mt-Signature HMAC header. This allows unauthenticated POST requests to forge Mailtrap delivery, bounce, open, click, or spam events. The issue was fixed in versions 7.4.12 and 8.0.12.

Detection Guidance

Check Symfony Mailtrap webhook endpoints for POST requests without a valid X-Mt-Signature header. Use tools like curl to test endpoints: curl -X POST -H 'Content-Type: application/json' -d '{"test":"data"}' http://your-webhook-url. If the server does not reject requests without the header, the system is vulnerable.

Impact Analysis

Attackers can send forged webhook events to your Mailtrap webhook endpoint. This could manipulate delivery metrics, corrupt suppression lists, or create fake bounce/open/click/spam events. The impact depends on how Mailtrap webhooks are used in your application.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized data manipulation through forged webhook events. For GDPR, it may affect data integrity requirements. For HIPAA, it could compromise audit logs if fake events are recorded. Organizations must ensure webhook integrity to maintain compliance.

Mitigation Strategies

Upgrade Symfony to versions 7.4.12 or 8.0.12 or later. Ensure Mailtrap webhook endpoints validate the X-Mt-Signature header using hash_equals for secure comparison. Review webhook logs for unauthorized POST requests.

Hi! I’m here to help you understand CVE-2026-45755. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70