CVE-2026-45754: Symfony Auth Bypass Vulnerability

CVE-2026-45754 Overview

CVE-2026-45754 is an authentication bypass vulnerability in the Symfony PHP framework affecting the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers. The parsers accepted configured webhook secrets but never verified them against incoming requests. Unauthenticated attackers can send crafted POST requests to inject forged Mailjet and LOX24 event payloads. The flaw is classified under [CWE-287] (Improper Authentication) and affects Symfony versions prior to 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
Attackers can forge webhook events without credentials, corrupting downstream mail delivery status tracking and SMS event processing in applications that rely on these bridges.

Affected Products

Symfony versions prior to 6.4.40 (Mailjet mailer bridge, LOX24 notifier bridge)
Symfony versions prior to 7.4.12 (Mailjet mailer bridge, LOX24 notifier bridge)
Symfony versions prior to 8.0.12 (Mailjet mailer bridge, LOX24 notifier bridge)

Discovery Timeline

2026-07-14 - CVE-2026-45754 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-45754

Vulnerability Analysis

The vulnerability resides in two webhook request parsers shipped with Symfony bridges. Both MailjetRequestParser and Lox24RequestParser accept a $secret parameter marked with #[\SensitiveParameter]. Neither parser compared the configured secret against credentials in the incoming HTTP request. The doParse() methods moved directly to payload conversion without any verification step.

Applications using these bridges expose webhook endpoints to receive delivery events, bounce notifications, and SMS status updates. Without authentication, an attacker who knows a target webhook URL can post arbitrary event payloads. Forged events can corrupt suppression lists, mark real messages as bounced, or trigger downstream logic tied to notifier events.

Root Cause

The root cause is missing authentication logic on trust boundary code. Symfony's webhook infrastructure supplies a shared secret to each bridge parser, and each bridge is responsible for validating incoming credentials. The Mailjet parser expected HTTP Basic authentication, while the LOX24 parser expected an X-LOX24-Token header. Both parsers dropped this validation, treating any request as authorized.

Attack Vector

Exploitation requires network access to the webhook endpoint and no privileges or user interaction. An attacker sends a POST request containing a JSON or form payload matching the expected Mailjet or LOX24 event schema. The parser converts the payload into an event object and dispatches it to application handlers.

php

// Mailjet parser fix — src/Symfony/Component/Mailer/Bridge/Mailjet/Webhook/MailjetRequestParser.php
protected function doParse(Request $request, #[\SensitiveParameter] string $secret): ?AbstractMailerEvent
{
    if ($secret && !hash_equals('Basic '.base64_encode($secret), $request->headers->get('Authorization', ''))) {
        throw new RejectWebhookException(403, 'Invalid credentials.');
    }

    try {
        return $this->converter->convert($request->toArray());
    } catch (ParseException $e) {
        // ...
    }
}

Source: Symfony commit 3e52bf5

php

// LOX24 parser fix — src/Symfony/Component/Notifier/Bridge/Lox24/Webhook/Lox24RequestParser.php
protected function doParse(Request $request, #[\SensitiveParameter] string $secret): SmsEvent|RemoteEvent|null
{
    if ('' !== $secret) {
        $provided = $request->headers->get('X-LOX24-Token');
        if (null === $provided || !hash_equals($secret, $provided)) {
            throw new RejectWebhookException(406, 'Invalid or missing webhook token.');
        }
    }

    $payload = $request->request->all() ?? [];
    $name = $payload['name'] ?? null;
    $data = $payload['data'] ?? null;
}

Source: Symfony commit 4aaa45d

Both patches use hash_equals() to prevent timing side-channel attacks during secret comparison.

Detection Methods for CVE-2026-45754

Indicators of Compromise

POST requests to Mailjet webhook endpoints missing an Authorization: Basic header or containing invalid credentials.
POST requests to LOX24 webhook endpoints missing the X-LOX24-Token header or presenting an unknown token value.
Unexpected surges in mailer bounce, spam, or delivery events without corresponding outbound mail volume.
Unusual SMS event notifications logged by applications using the LOX24 notifier bridge.

Detection Strategies

Review web server access logs for POST requests to configured Mailjet and LOX24 webhook paths and correlate against expected source IP ranges published by each provider.
Instrument webhook handlers to log the presence and shape of Authorization and X-LOX24-Token headers during a transition window.
Compare inbound webhook event counts against provider-side dashboards to identify forged event injection.

Monitoring Recommendations

Enable application-level logging of RejectWebhookException events after upgrading to identify ongoing forgery attempts.
Alert on repeated 403 responses from Mailjet webhook endpoints and 406 responses from LOX24 endpoints originating from a single source.
Track Symfony framework version inventory across services to identify hosts still running vulnerable releases.

How to Mitigate CVE-2026-45754

Immediate Actions Required

Upgrade Symfony to 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Verify that a non-empty webhook secret is configured for every Mailjet and LOX24 bridge; the patched parsers only enforce validation when a secret is present.
Rotate any Mailjet Basic credentials and LOX24 tokens that may have been exposed while the vulnerability was live.
Audit downstream systems for actions taken in response to potentially forged bounce, complaint, or SMS status events.

Patch Information

The fix is available in Symfony releases v6.4.40, v7.4.12, and v8.0.12. Full technical details are published in GitHub Security Advisory GHSA-64hg-93w9-fc35. The Mailjet fix is in commit 3e52bf5 and the LOX24 fix is in commit 4aaa45d.

Workarounds

Restrict access to Mailjet and LOX24 webhook endpoints to the provider's published egress IP ranges via a reverse proxy or web application firewall.
Terminate incoming webhook requests at a middleware layer that validates the Authorization header (Basic scheme for Mailjet) or X-LOX24-Token header (for LOX24) before the request reaches the Symfony application.
Disable the Mailjet mailer bridge or LOX24 notifier bridge if webhook processing is not required.

bash

# Composer upgrade example for the 6.4 LTS branch
composer require symfony/mailer:^6.4.40 symfony/notifier:^6.4.40

# Verify installed versions
composer show symfony/mailer symfony/notifier | grep versions