Symfony's MailtrapRequestParser ignores the X‑Mt‑Signature HMAC header even though it receives the configured webhook secret, allowing unauthenticated POST requests to forge Mailtrap delivery, bounce, open, click, or spam events. An attacker could inject false notifications, potentially misleading monitoring or analytics systems. This flaw represents a missing signature verification (CWE‑306) and an unvalidated header usage (CWE‑347).

Vendors: Mailtrap Mailer and Symfony. Product: the MailtrapRequestParser component within the Symfony framework. Versions affected are all releases prior to Symfony 7.4.12 and 8.0.12; specifically, Symfony 7.4.x before 7.4.12 and Symfony 8.0.x before 8.0.12. No further version details are provided.

The CVSS base score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated POST request to the webhook endpoint with a forged or missing X‑Mt‑Signature header, allowing injection of arbitrary event data.