CVE-2026-47212: Symfony Authentication Bypass Vulnerability

CVE-2026-47212 Overview

CVE-2026-47212 is a missing authentication vulnerability [CWE-306] in the Symfony PHP framework's Twilio Notifier bridge. The TwilioRequestParser::doParse() method received the configured webhook secret but failed to validate the X-Twilio-Signature HMAC header. Unauthenticated attackers can send forged Twilio status payloads over the network to any endpoint consuming Twilio webhooks. Successful exploitation lets attackers inject fabricated SMS delivery events into application workflows without possessing the Twilio auth token. The issue affects Symfony versions prior to 6.4.40, 7.4.12, and 8.0.12.

Critical Impact
Unauthenticated network attackers can inject forged Twilio webhook payloads, corrupting notification state and downstream business logic that trusts Twilio-signed events.

Affected Products

Symfony 6.4.x prior to 6.4.40
Symfony 7.4.x prior to 7.4.12
Symfony 8.0.x prior to 8.0.12

Discovery Timeline

2026-07-14 - CVE-2026-47212 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47212

Vulnerability Analysis

The defect lives in src/Symfony/Component/Notifier/Bridge/Twilio/Webhook/TwilioRequestParser.php. Twilio signs webhook requests with an HMAC-SHA1 signature over the request URL and POST parameters, delivered in the X-Twilio-Signature header. Consumers are expected to recompute the HMAC using the Twilio auth token and reject any request with a mismatched signature.

Symfony's parser accepted the configured secret at construction time but never invoked signature verification during request parsing. Any process able to reach the webhook endpoint could POST a valid-looking payload containing fields such as MessageStatus, MessageSid, and From, and Symfony would dispatch a corresponding SmsEvent (DELIVERED, FAILED, etc.) as if it originated from Twilio.

Root Cause

The root cause is a missing authentication check for a critical function [CWE-306]. The parser trusted the payload structure alone and did not compare the received HMAC against a locally computed value. Because no signature validation existed, the shared secret provided defense in name only.

Attack Vector

Exploitation requires only network access to a publicly reachable Twilio webhook endpoint exposed by a vulnerable Symfony application. An attacker crafts an HTTP POST request matching Twilio's status callback schema and submits it without any X-Twilio-Signature header or with an arbitrary value. The application processes the event, updating message state, triggering retries, marking messages delivered, or firing downstream listeners that assume authenticity.

php

            throw new RejectWebhookException(406, 'Payload is malformed.');
        }

+       if ('' !== $secret) {
+           $this->verifySignature($request, $payload, $secret);
+       }
+
        $name = match ($payload['MessageStatus']) {
            'delivered' => SmsEvent::DELIVERED,
            'failed' => SmsEvent::FAILED,

Source: Symfony patch commit 8545fb2. The patch calls verifySignature() after payload parsing when a non-empty secret is configured, restoring HMAC validation.

Detection Methods for CVE-2026-47212

Indicators of Compromise

POST requests to Twilio webhook routes missing the X-Twilio-Signature header or presenting malformed signature values.
Duplicate or out-of-sequence MessageStatus transitions for the same MessageSid originating from unexpected source IP addresses.
Webhook traffic from source IPs outside Twilio's documented IP ranges reaching the notifier endpoint.

Detection Strategies

Deploy web application firewall rules that require and validate the X-Twilio-Signature header on all routes bound to TwilioRequestParser.
Log the presence and content of X-Twilio-Signature at the reverse proxy and alert on absent headers or signature verification failures.
Correlate inbound webhook counts against outbound Twilio SMS send volume; large disparities indicate injected events.

Monitoring Recommendations

Enable request-level logging on Symfony notifier controllers and forward events to a centralized SIEM for correlation.
Monitor Composer manifest changes for symfony/notifier package versions below 6.4.40, 7.4.12, or 8.0.12.
Track application logs for SmsEvent dispatches lacking a preceding outbound Twilio API call.

How to Mitigate CVE-2026-47212

Immediate Actions Required

Upgrade Symfony to 6.4.40, 7.4.12, or 8.0.12 depending on the branch in use.
Confirm that a non-empty Twilio webhook secret (auth token) is configured for every notifier transport.
Audit application logs for anomalous SmsEvent dispatches since the webhook endpoint went live.

Patch Information

The fix is available in Symfony 6.4.40, Symfony 7.4.12, and Symfony 8.0.12. Full details are documented in GitHub Security Advisory GHSA-55rj-x2vc-4whq.

Workarounds

Restrict access to the Twilio webhook route to Twilio's published IP ranges at the reverse proxy or WAF layer.
Implement middleware that computes the HMAC-SHA1 signature over the request URL and body and rejects requests with mismatched X-Twilio-Signature values.
Temporarily disable the Twilio notifier bridge if upgrade is not immediately possible.

bash

# Upgrade via Composer
composer require symfony/notifier:^6.4.40
# or
composer require symfony/notifier:^7.4.12
# or
composer require symfony/notifier:^8.0.12