GHSA-59F3-VP2F-MP9W Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

🗓️ 28 May 2026 17:33:47Reported by GoogleType

osv

osv🔗 osv.dev👁 4 Views

Mailtrap webhook parser now verifies signature before decoding to block unauthenticated events.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-45755	20 May 202611:01	–	circl
CVE	CVE-2026-45755	1 Jan 197000:00	–	cve
Debian CVE	CVE-2026-45755	1 Jan 197000:00	–	debiancve
Friends Of PHP	CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	CVE-2026-45755: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC: Unauthenticated Webhook Event Injection	1 Jan 197000:00	–	friendsofphp
Github Security Blog	Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection	28 May 202617:33	–	github
OSV	DEBIAN-CVE-2026-45755	21 May 202605:48	–	osv
OSV	UBUNTU-CVE-2026-45755	21 May 202600:00	–	osv
Positive Technologies	PT-2026-44547	21 May 202600:00	–	ptsecurity
Snyk	Missing Authentication for Critical Function	20 May 202615:35	–	snyk

Source	Link
github	www.github.com/symfony/symfony/security/advisories/GHSA-59f3-vp2f-mp9w
github	www.github.com/symfony/symfony/commit/4e0467e4e182cf2e704a3d9e1bc1a6be65d52ab8
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailtrap-mailer/CVE-2026-45755.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45755.yaml
github	www.github.com/symfony/symfony
symfony	www.symfony.com/cve-2026-45755

28 May 2026 17:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.7

EPSS0.00026

mailtrap webhook signature verification authentication payload decoding endpoint events