Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

🗓️ 28 May 2026 17:33:47Reported by GitHub Advisory DatabaseType

Symfony Mailer webhook parser did not verify X-Mt-Signature; now validates HMAC-SHA256.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-45755	20 May 202611:01	–	circl
CVE	CVE-2026-45755	1 Jan 197000:00	–	cve
Debian CVE	CVE-2026-45755	1 Jan 197000:00	–	debiancve
Friends Of PHP	CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection	1 Jan 197000:00	–	friendsofphp
OSV	DEBIAN-CVE-2026-45755	21 May 202605:48	–	osv
OSV	GHSA-59F3-VP2F-MP9W Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection	28 May 202617:33	–	osv
OSV	UBUNTU-CVE-2026-45755	21 May 202600:00	–	osv
Positive Technologies	PT-2026-44547	21 May 202600:00	–	ptsecurity
Snyk	Missing Authentication for Critical Function	20 May 202615:35	–	snyk

Vulners

Node

symfony symfonyRange8.0.0–8.0.12composer

symfony symfonyRange7.2.0–7.4.12composer

symfony mailtrap-mailerRange8.0.0–8.0.12composer

symfony mailtrap-mailerRange7.2.0–7.4.12composer

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-59f3-vp2f-mp9w
github	www.github.com/symfony/symfony/commit/4e0467e4e182cf2e704a3d9e1bc1a6be65d52ab8
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailtrap-mailer/CVE-2026-45755.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45755.yaml
symfony	www.symfony.com/cve-2026-45755
github	www.github.com/advisories/GHSA-59f3-vp2f-mp9w

28 May 2026 17:33Current

5.8Medium risk

Vulners AI Score5.8

EPSS0.00026