CVE-2026-47212

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Symfony via Twilio Webhook

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inject forged Twilio status payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-47212

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 6.4.0 (inc) to 6.4.40 (exc)
sensiolabs	symfony	From 7.0.0 (inc) to 7.4.12 (exc)
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Symfony PHP framework's Twilio webhook parser. The doParse() method fails to verify the X-Twilio-Signature HMAC header even when a webhook secret is configured. This allows unauthenticated attackers to forge Twilio status payloads by sending arbitrary POST requests to the webhook endpoint.

Detection Guidance

Check Symfony and Twilio Notifier package versions using commands like 'composer show symfony/symfony' or 'composer show symfony/twilio-notifier'. If versions are >=6.4 and <6.4.40, >=7.0 and <7.4.12, or >=8.0 and <8.0.12, the system is vulnerable.

Impact Analysis

Attackers could inject fake Twilio webhook events such as delivered, failed, or undelivered statuses into your system. This could lead to incorrect data processing, false notifications, or potential workflow disruptions in applications using affected Symfony versions.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized data injection. For GDPR, it may affect integrity of message records. For HIPAA, it could compromise audit trails. Proper authentication is often required for compliance with these standards.

Mitigation Strategies

Upgrade Symfony to versions 6.4.40, 7.4.12, or 8.0.12 or later.
Ensure the X-Twilio-Signature HMAC header is properly verified in webhook endpoints.
If using a reverse proxy, configure trusted proxies and headers for correct URL validation.

Hi! I’m here to help you understand CVE-2026-47212. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70