Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.
Published: 2026-07-14
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Before versions 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed the X-MOM-Webhook-Signature header, treating its algorithm value as requested, and passed that choice to hash_hmac(). This permitted a signature algorithm downgrade rather than enforcing Mailomat’s documented SHA-256 requirement. The weakness could allow an attacker to forge webhook notifications and perform unauthorized actions. The problem is fixed in Symfony 7.4.13 and 8.0.13.

Affected Systems

Symfony (Mailomat Mailer component). All Symfony releases before 7.4.13 and 8.0.13 are affected. Versions 7.4.13 and 8.0.13 include the fix.

Risk and Exploitability

The CVSS score is 6.3, indicating a moderate severity, while the EPSS score is < 1 %, suggesting a low likelihood of exploitation in the wild. Attackers would need to send a malicious HTTP request to the Mailomat webhook endpoint and supply a weaker algorithm in the X-MOM-Webhook-Signature header. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been observed yet.

Generated by OpenCVE AI on July 31, 2026 at 05:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Symfony to version 7.4.13 or 8.0.13 or later
  • Re‑generate and distribute new webhook HMAC keys after the upgrade
  • Verify that the webhook handler uses the enforced SHA-256 algorithm and rejects any other algorithm

Generated by OpenCVE AI on July 31, 2026 at 05:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rrj9-5q2j-4gvr Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
History

Mon, 27 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Symfony
Symfony mailomat-mailer
Symfony symfony
Vendors & Products Symfony
Symfony mailomat-mailer
Symfony symfony

Thu, 16 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Description Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.
Title Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
Weaknesses CWE-347
CWE-757
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Symfony Mailomat-mailer Symfony
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-15T14:22:53.743Z

Reserved: 2026-05-22T19:10:35.747Z

Link: CVE-2026-48747

cve-icon Vulnrichment

Updated: 2026-07-15T14:22:48.178Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T05:45:03Z

Weaknesses
  • CWE-347

    Improper Verification of Cryptographic Signature

  • CWE-757

    Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')