Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

🗓️ 15 Jun 2026 17:32:28Reported by GitHub Advisory DatabaseType

Symfony Mailomat webhook now requires a sha256 header and uses constant-time HMAC-SHA256 verification.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-48747	27 May 202610:03	–	circl
CVE	CVE-2026-48747	27 May 202610:03	–	cve
Debian CVE	CVE-2026-48747	27 May 202610:03	–	debiancve
Friends Of PHP	CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2026-48747: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	1 Jan 197000:00	–	friendsofphp
OSV	DEBIAN-CVE-2026-48747	27 May 202619:48	–	osv
OSV	GHSA-RRJ9-5Q2J-4GVR Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	15 Jun 202617:32	–	osv
OSV	UBUNTU-CVE-2026-48747	29 May 202600:00	–	osv
Positive Technologies	PT-2026-44170	27 May 202600:00	–	ptsecurity
Snyk	Improper Verification of Cryptographic Signature	27 May 202609:41	–	snyk

Vulners

Node

symfony symfonyRange8.0.0–8.0.13composer

symfony symfonyRange7.2.0–7.4.13composer

symfony mailomat-mailerRange8.0.0–8.0.13composer

symfony mailomat-mailerRange7.2.0–7.4.13composer

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-rrj9-5q2j-4gvr
github	www.github.com/symfony/symfony/commit/bdfe9fe0d94d33dfaca0bc2fe0b00b54767b0c88
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailomat-mailer/CVE-2026-48747.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-48747.yaml
symfony	www.symfony.com/cve-2026-48747
github	www.github.com/advisories/GHSA-rrj9-5q2j-4gvr

15 Jun 2026 17:32Current

5.5Medium risk

Vulners AI Score5.5

EPSS0.00018