CVE-2026-48747: Symfony Auth Bypass Vulnerability

CVE-2026-48747 Overview

CVE-2026-48747 affects the Symfony PHP framework's Mailomat mailer bridge. The MailomatRequestParser::validateSignature() method parses the X-MOM-Webhook-Signature header as an algo=signature pair and passes the client-controlled algorithm directly to hash_hmac(). This behavior enables a signature algorithm downgrade attack against Mailomat webhook verification, bypassing the vendor's documented SHA-256 signature requirement. The flaw maps to [CWE-347: Improper Verification of Cryptographic Signature]. Symfony maintainers fixed the issue in versions 7.4.13 and 8.0.13 by pinning the algorithm to SHA-256.

Critical Impact
Attackers can forge Mailomat webhook requests by selecting weaker hash algorithms, allowing untrusted webhook payloads to be accepted as authentic by Symfony applications.

Affected Products

Symfony versions prior to 7.4.13
Symfony versions prior to 8.0.13
Applications using the symfony/mailer Mailomat bridge for webhook processing

Discovery Timeline

2026-07-14 - CVE-2026-48747 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48747

Vulnerability Analysis

The vulnerability resides in the Mailomat webhook signature verification logic within src/Symfony/Component/Mailer/Bridge/Mailomat/Webhook/MailomatRequestParser.php. The parser splits the X-MOM-Webhook-Signature header on = and treats the left side as the hash algorithm name. It then invokes hash_hmac($algo, $data, $secret) using the attacker-supplied algorithm value.

Mailomat's webhook security specification requires HMAC-SHA-256. The Symfony implementation never enforces this constraint, so any algorithm supported by PHP's hash_hmac() function is accepted. An attacker who controls the header value can select a weaker algorithm or an algorithm whose output they can compute or predict, then submit a matching signature.

Root Cause

The root cause is trust of an unauthenticated input as a security-critical parameter. The verification routine treats the algorithm identifier as data supplied by the sender rather than as a fixed protocol constant. The code path never compares the parsed algorithm to the expected value before invoking the HMAC function.

Attack Vector

Exploitation requires an attacker to send an HTTP request to a Symfony application endpoint that consumes Mailomat webhooks. The attacker crafts an X-MOM-Webhook-Signature header of the form algo=signature, choosing an algorithm and computing the corresponding HMAC value if the secret is guessable, leaked, or otherwise recoverable. Successful forgery causes the application to process attacker-controlled webhook payloads as legitimate Mailomat notifications.

php

// see https://api.mailomat.swiss/docs/#tag/webhook-security
$data = implode('.', [$headers->get(self::HEADER_ID), $headers->get(self::HEADER_EVENT), $headers->get(self::HEADER_TIMESTAMP)]);

-        [$algo, $signature] = explode('=', $headers->get(self::HEADER_SIGNATURE));
-        if (!hash_equals(hash_hmac($algo, $data, $secret), $signature)) {
+        [$algo, $signature] = explode('=', $headers->get(self::HEADER_SIGNATURE), 2) + [1 => ''];
+        if ('sha256' !== $algo || !hash_equals(hash_hmac('sha256', $data, $secret), $signature)) {
     throw new RejectWebhookException(406, 'Signature is wrong.');
 }

Source: Symfony patch commit bdfe9fe0. The fix pins the algorithm to sha256 and rejects any request whose signature header specifies a different algorithm.

Detection Methods for CVE-2026-48747

Indicators of Compromise

Inbound HTTP requests to Mailomat webhook endpoints containing X-MOM-Webhook-Signature header values that do not begin with sha256=.
Webhook processing logs showing accepted signatures using algorithms such as md5, sha1, or crc32.
Unexpected RejectWebhookException entries after upgrading to Symfony 7.4.13 or 8.0.13, indicating prior traffic used non-SHA-256 signatures.

Detection Strategies

Inspect application logs and web server access logs for the X-MOM-Webhook-Signature header and alert on any algorithm prefix other than sha256.
Deploy a Web Application Firewall (WAF) rule that blocks or flags Mailomat webhook requests whose signature header does not match the pattern ^sha256=[a-f0-9]{64}$.
Review installed Composer dependencies for symfony/mailer versions below 7.4.13 or 8.0.13 across all application repositories.

Monitoring Recommendations

Enable structured logging on the Mailomat webhook controller to capture signature header contents and validation outcomes.
Correlate webhook processing events with downstream actions such as email status updates or bounce handling to identify anomalous state changes.
Track HTTP 406 responses from webhook endpoints as an indicator of continued forgery attempts after patching.

How to Mitigate CVE-2026-48747

Immediate Actions Required

Upgrade Symfony to version 7.4.13 or 8.0.13 as soon as possible using composer update symfony/mailer.
Rotate the Mailomat webhook secret if there is any indication that webhook forgery may have occurred.
Audit application code that consumes Mailomat webhook data for downstream trust assumptions that depend on signature validity.

Patch Information

The fix is available in Symfony releases v7.4.13 and v8.0.13. Full technical details are published in GitHub Security Advisory GHSA-rrj9-5q2j-4gvr. The patch enforces sha256 as the sole accepted algorithm and hardens the header parsing against malformed input.

Workarounds

Place a reverse proxy or WAF rule in front of the Mailomat webhook endpoint that rejects requests whose X-MOM-Webhook-Signature header does not start with sha256=.
Temporarily disable the Mailomat webhook route until patched versions can be deployed, if webhook processing is not business-critical.
Perform independent SHA-256 HMAC verification of the webhook payload inside application middleware before invoking Symfony's built-in parser.

bash

# Upgrade Symfony Mailer to a patched release
composer require symfony/mailer:^7.4.13
# or for the 8.x branch
composer require symfony/mailer:^8.0.13

# Verify the installed version
composer show symfony/mailer | grep versions