CVE-2026-48747

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Symfony PHP Framework

Publication date: 2026-07-14

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-48747

Affected Vendors & Products

Vendor	Product	Version / Range
sensiolabs	symfony	From 8.0.0 (inc) to 8.0.13 (exc)
sensiolabs	symfony	From 7.2.0 (inc) to 7.4.13 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-757	A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

Attack-Flow Graph

Executive Summary

This vulnerability in Symfony's Mailer component involves the Mailomat webhook signature parser. The MailomatRequestParser::validateSignature() function incorrectly allowed the HMAC algorithm to be dynamically selected via the X-MOM-Webhook-Signature header, enabling weaker algorithms like MD5 or SHA-1 instead of enforcing SHA-256 as documented. This created a signature algorithm downgrade vulnerability.

Detection Guidance

To detect this vulnerability, check if your Symfony application uses versions 7.4.12 or lower or 8.0.12 or lower. Inspect the Mailomat webhook signature handling in your code or logs for improper algorithm parsing. Look for requests with X-MOM-Webhook-Signature headers that do not strictly follow the sha256=<hex> format.

Impact Analysis

An attacker could exploit this to bypass signature verification, potentially leading to unauthorized actions or data exposure. By using weaker algorithms, they might forge webhook signatures and manipulate payloads, causing unintended system behavior or data tampering.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements for protected health information. Non-compliance risks include legal penalties and reputational damage due to insufficient cryptographic protections.

Mitigation Strategies

Immediately upgrade Symfony to version 7.4.13 or 8.0.13 or later. Ensure the Mailomat webhook signature header strictly follows the sha256=<hex> format. Validate that only SHA-256 is used for HMAC verification in your webhook processing logic.

Hi! I’m here to help you understand CVE-2026-48747. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70