CVE-2026-45754 json
Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
published 2026-05-28 5 mo ago modified 2026-09-10 1 mo ago also GHSA-64hg-93w9-fc35 , EUVD-2026-44360
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Patch / fix
- packagist symfony/lox24-notifier 7.4.12, 8.0.12
- packagist symfony/symfony 6.4.40, 7.4.12, 8.0.12
- packagist symfony/mailjet-mailer 6.4.40, 7.4.12, 8.0.12
- sensiolabs symfony 6.4.40, 7.4.12, 8.0.12
- symfony Debian 13 6.4.41+dfsg-0+deb13u1
- symfony Debian 14 7.4.12+dfsg-1
debian advisories DEBIAN-CVE-2026-45754
- github.com/symfony/symfony@3e52bf5 commit
- github.com/symfony/symfony@4aaa45d commit
- github.com/symfony/symfony/releases/tag/v6.4.40 release
- github.com/symfony/symfony/releases/tag/v7.4.12 release
- github.com/symfony/symfony/releases/tag/v8.0.12 release
- github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | symfony/lox24-notifier | >=7.1.0, <7.4.12 >=8.0.0, <8.0.12 |
7.4.12 8.0.12 |
| packagist | symfony/symfony | >=6.4.0, <6.4.40 >=7.0.0, <7.4.12 >=8.0.0, <8.0.12 |
6.4.40 7.4.12 8.0.12 |
| packagist | symfony/mailjet-mailer | >=6.4.0, <6.4.40 >=7.0.0, <7.4.12 >=8.0.0, <8.0.12 |
6.4.40 7.4.12 8.0.12 |
Affected products
- symfony symfony
- symfony lox24-notifier
- symfony mailjet-mailer
Classification
References
-
github.com
/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838e
patch
-
github.com
/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77
web, patch
-
github.com
/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35
web, patch, vendor-advisory
-
github.com
/symfony/symfony/releases/tag/v6.4.40
release-notes
-
github.com
/symfony/symfony/releases/tag/v7.4.12
release-notes
-
github.com
/symfony/symfony/releases/tag/v8.0.12
release-notes
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/lox24-notifier/CVE-2026-45754.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/mailjet-mailer/CVE-2026-45754.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45754.yaml
web
-
github.com
/symfony/symfony
package
-
symfony.com
/cve-2026-45754
web
Sources
- CVE List CVE-2026-45754
- GitHub Advisory GHSA-64hg-93w9-fc35
- NVD CVE-2026-45754
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.