CVE-2026-45754 - Vulnerability Details

- Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Published: 2026-07-14

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Symfony’s Mailjet mailer bridge and LOX24 notifier bridge webhook parsers, prior to Symfony 6.4.40, 7.4.12, and 8.0.12, receive configured webhook secrets but do not validate them. This allows unauthenticated POST requests to inject forged Mailjet or LOX24 event payloads that the framework processes as legitimate, potentially causing false event triggers or unwanted state changes. The vulnerability is an Authentication Failure and Missing Authentication Exception (CWE-287, CWE-306) and has been fixed in the listed releases.

Affected Systems

The vulnerability affects the Symfony framework components for the Mailjet mailer bridge and LOX24 notifier bridge. Users of Symfony versions prior to 6.4.40, 7.4.12, and 8.0.12 are impacted. Updating to any of these or newer releases eliminates the flaw.

Risk and Exploitability

The CVSS score is 6.9, indicating moderate severity. The EPSS score is below 1%, showing a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the issue can be exploited remotely via unauthenticated HTTP POST requests to the exposed webhook endpoints, requiring only network access to the target without any authentication.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

symfony

affected

Version	Status	Constraints
`>= 6.4.0, < 6.4.40`	affected	—
`>= 7.0.0-BETA1, < 7.4.12`	affected	—
`>= 8.0.0-BETA1, < 8.0.12`	affected	—

symfony

lox24-notifier

affected

Version	Status	Constraints
`>= 7.1.0-BETA1, < 7.4.12`	affected	—
`>= 8.0.0-BETA1, < 8.0.12`	affected	—

symfony

mailjet-mailer

affected

Version	Status	Constraints
`>= 6.4.0, < 6.4.40`	affected	—
`>= 7.0.0-BETA1, < 7.4.12`	affected	—
`>= 8.0.0-BETA1, < 8.0.12`	affected	—

No data.

Vendor Product Confidence Versions

Symfony

Lox24-notifier

100%

Version	Status	Scheme	Platform
`[7.1.0-BETA1,7.4.12)`	affected	semver	—
`[8.0.0-BETA1,8.0.12)`	affected	semver	—

Symfony

Mailjet-mailer

100%

Version	Status	Scheme	Platform
`[6.4.0,6.4.40)`	affected	semver	—
`[7.0.0-BETA1,7.4.12)`	affected	semver	—
`[8.0.0-BETA1,8.0.12)`	affected	semver	—

Symfony

100%

Version	Status	Scheme	Platform
`[6.4.0,6.4.40)`	affected	semver	—
`[7.0.0-BETA1,7.4.12)`	affected	semver	—
`[8.0.0-BETA1,8.0.12)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Symfony to a patched version (>= 6.4.40, >= 7.4.12, or >= 8.0.12).
If an upgrade is not immediately possible, disable or remove the vulnerable webhook handlers until a fix can be applied.
Implement a manual check of the webhook secret (or use a firewall rule) to validate incoming payloads before processing.

Generated by OpenCVE AI on July 31, 2026 at 05:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6312-1	symfony security update
Github GHSA	GHSA-64hg-93w9-fc35	Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00348.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838e
https://github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77
https://github.com/symfony/symfony/releases/tag/v6.4.40
https://github.com/symfony/symfony/releases/tag/v7.4.12
https://github.com/symfony/symfony/releases/tag/v8.0.12
https://github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35

History

Mon, 27 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Symfony Symfony lox24-notifier Symfony mailjet-mailer Symfony symfony
Vendors & Products		Symfony Symfony lox24-notifier Symfony mailjet-mailer Symfony symfony

Tue, 21 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 14 Jul 2026 19:00:00 +0000

Type	Values Removed	Values Added
Description		Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Title		Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
Weaknesses		CWE-287 CWE-306
References		https://github.com/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838e https://github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77 https://github.com/symfony/symfony/releases/tag/v6.4.40 https://github.com/symfony/symfony/releases/tag/v7.4.12 https://github.com/symfony/symfony/releases/tag/v8.0.12 https://github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}`

Subscriptions

Symfony Lox24-notifier Mailjet-mailer Symfony

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-07-14T18:54:24.337Z

Updated: 2026-07-21T17:54:06.698Z

Reserved: 2026-05-13T06:54:34.221Z

Link: CVE-2026-45754

Vulnrichment

Updated: 2026-07-21T17:54:02.476Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-31T05:45:03Z

Weaknesses

CWE-287
Improper Authentication
CWE-306
Missing Authentication for Critical Function

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object