CVE-2026-45755: Symfony Auth Bypass Vulnerability

CVE-2026-45755 Overview

CVE-2026-45755 affects the Symfony PHP framework's Mailtrap webhook parser component. The MailtrapRequestParser::doParse() method received the configured webhook secret but ignored the X-Mt-Signature HMAC header. This flaw allows unauthenticated attackers to send forged POST requests that inject fake Mailtrap delivery, bounce, open, click, or spam events into an application. The issue affects Symfony versions prior to 7.4.12 and 8.0.12, and is categorized as Missing Authentication for Critical Function [CWE-306]. Applications using the Symfony Mailer Mailtrap bridge for webhook processing are exposed to event spoofing and downstream logic manipulation.

Critical Impact
Unauthenticated remote attackers can inject forged email delivery, bounce, open, click, and spam events into Symfony applications using the Mailtrap webhook bridge, corrupting analytics, suppression lists, and any downstream automation triggered by these events.

Affected Products

Symfony framework versions prior to 7.4.12
Symfony framework versions prior to 8.0.12
Symfony Mailer Mailtrap Bridge component (symfony/mailer)

Discovery Timeline

2026-07-14 - CVE-2026-45755 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-45755

Vulnerability Analysis

The vulnerability resides in src/Symfony/Component/Mailer/Bridge/Mailtrap/Webhook/MailtrapRequestParser.php. The doParse() method accepted a $secret parameter intended for HMAC verification but never performed the signature check. Any HTTP POST request reaching the configured Mailtrap webhook endpoint was accepted and processed as a legitimate event notification.

Mailtrap normally signs webhook payloads with HMAC-SHA256 using a shared secret, transmitted via the Mailtrap-Signature header (also referenced as X-Mt-Signature). By skipping this verification, Symfony treated attacker-controlled JSON payloads as authentic Mailtrap events. Attackers can forge delivery, bounce, open, click, or spam events to poison analytics, trigger unsubscribe logic, or manipulate suppression lists.

Root Cause

The root cause is missing authentication on a critical function. The parser was wired to receive the secret but never validated the incoming HMAC signature, leaving the webhook endpoint effectively open to unauthenticated clients.

Attack Vector

Exploitation requires only network access to the application's Mailtrap webhook route. An attacker crafts a JSON body mimicking a Mailtrap event and issues a POST request without any signature header. The parser accepts the payload and dispatches the corresponding RemoteEvent, which downstream listeners consume as authentic.

php

// Security patch in MailtrapRequestParser.php
// Source: https://github.com/symfony/symfony/commit/4e0467e4e182cf2e704a3d9e1bc1a6be65d52ab8

protected function doParse(Request $request, #[\SensitiveParameter] string $secret): RemoteEvent|array|null
{
    if ($secret) {
        if (!$signature = $request->headers->get('Mailtrap-Signature')) {
            throw new RejectWebhookException(406, 'Signature is required.');
        }

        if (!hash_equals(hash_hmac('sha256', $request->getContent(), $secret), $signature)) {
            throw new RejectWebhookException(406, 'Signature is wrong.');
        }
    }

    $payload = $request->toArray();
    // ...
}

The patch enforces two checks when a secret is configured: the Mailtrap-Signature header must be present, and its value must match a constant-time comparison of the HMAC-SHA256 digest computed over the raw request body.

Detection Methods for CVE-2026-45755

Indicators of Compromise

POST requests to Mailtrap webhook endpoints missing the Mailtrap-Signature or X-Mt-Signature header.
Requests to the webhook route originating from IP ranges not associated with Mailtrap's published sender infrastructure.
Sudden spikes in bounce, spam, or unsubscribe events not correlated with outbound mail volume.
Application logs showing RemoteEvent processing without corresponding entries in Mailtrap's outbound delivery reports.

Detection Strategies

Instrument the webhook controller to log the presence and validity of the Mailtrap-Signature header before upgrading to patched versions.
Correlate inbound webhook events with authoritative delivery records from the Mailtrap dashboard to identify injected events.
Deploy web application firewall rules that require the signature header on the configured Mailtrap webhook route.

Monitoring Recommendations

Monitor Symfony symfony/mailer package versions across your fleet using SCA tooling to identify hosts running pre-7.4.12 or pre-8.0.12 releases.
Alert on HTTP 200 responses from the webhook route for requests lacking a signature header.
Track anomalous changes to email suppression lists or subscriber states that could indicate forged event replay.

How to Mitigate CVE-2026-45755

Immediate Actions Required

Upgrade symfony/mailer and any affected Symfony bundles to version 7.4.12 or 8.0.12 as documented in GHSA-59f3-vp2f-mp9w.
Configure the Mailtrap webhook secret in your application so the newly enforced signature check activates.
Rotate any previously issued Mailtrap webhook secret to invalidate values that may have been exposed through logs or configuration snapshots.

Patch Information

The fix is delivered in Symfony v7.4.12 and v8.0.12. The corrective code is in commit 4e0467e4, which enforces presence of the Mailtrap-Signature header and validates it against an HMAC-SHA256 digest of the request body using hash_equals() for constant-time comparison.

Workarounds

If immediate upgrade is not possible, place the Mailtrap webhook route behind an authenticating reverse proxy or WAF that validates the Mailtrap-Signature HMAC before requests reach Symfony.
Restrict access to the webhook endpoint via IP allowlists limited to Mailtrap's documented source ranges.
Temporarily disable webhook consumption and rely on Mailtrap dashboard exports until patched versions can be deployed.

bash

# Update Symfony Mailer to a patched release
composer require symfony/mailer:^7.4.12
# or, for the 8.x branch
composer require symfony/mailer:^8.0.12

# Verify the installed version
composer show symfony/mailer | grep versions