The TwilioRequestParser in Symfony parses incoming Twilio webhook events. Prior to the security fix in versions 6.4.40, 7.4.12, and 8.0.12, it accepted the configured webhook secret but failed to verify the X‑Twilio‑Signature HMAC header, allowing unauthenticated POST requests to inject forged Twilio status payloads. This missing authentication (CWE‑306) and improper handling of sensitive data (CWE‑347) lets attackers alter status updates or trigger unintended logic without authorization, potentially compromising integrity or causing denial of service. The issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

Affected systems include all Symfony framework installations that depend on the Twilio Notifier component and run a version earlier than 6.4.40, 7.4.12, or 8.0.12. The issue is present in the Symfony core and the symfony:twilio-notifier package, which many PHP developers use to build webhook handlers for Twilio services.

The CVSS score of 6.9 places the vulnerability in the moderate severity range. The EPSS score is below 1%, indicating a low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP POST request sent to a Twilio webhook endpoint that hosts the affected Symfony application, exploiting the missing signature verification logic.