CVE-2026-45754 json
Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection
published 5mo ago modified last mo. also GHSA-64hg-93w9-fc35 , EUVD-2026-44360
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
Patch / fix
- packagist symfony/lox24-notifier 7.4.12, 8.0.12
- packagist symfony/symfony 6.4.40, 7.4.12, 8.0.12
- packagist symfony/mailjet-mailer 6.4.40, 7.4.12, 8.0.12
- sensiolabs symfony 6.4.40, 7.4.12, 8.0.12
- symfony Debian 13 6.4.41+dfsg-0+deb13u1
- symfony Debian 14 7.4.12+dfsg-1
debian advisories DEBIAN-CVE-2026-45754
- github.com/symfony/symfony@3e52bf5 commit
- github.com/symfony/symfony@4aaa45d commit
- github.com/symfony/symfony/releases/tag/v6.4.40 release
- github.com/symfony/symfony/releases/tag/v7.4.12 release
- github.com/symfony/symfony/releases/tag/v8.0.12 release
- github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35 advisory
Is CVE-2026-45754 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | symfony/lox24-notifier | >=7.1.0, <7.4.12 >=8.0.0, <8.0.12 |
7.4.12 8.0.12 |
| packagist | symfony/symfony | >=6.4.0, <6.4.40 >=7.0.0, <7.4.12 >=8.0.0, <8.0.12 |
6.4.40 7.4.12 8.0.12 |
| packagist | symfony/mailjet-mailer | >=6.4.0, <6.4.40 >=7.0.0, <7.4.12 >=8.0.0, <8.0.12 |
6.4.40 7.4.12 8.0.12 |
Affected products
- symfony symfony
- symfony lox24-notifier
- symfony mailjet-mailer
Classification
References
-
github.com
/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838e
patch
-
github.com
/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77
web, patch
-
github.com
/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35
web, patch, vendor-advisory
-
github.com
/symfony/symfony/releases/tag/v6.4.40
release-notes
-
github.com
/symfony/symfony/releases/tag/v7.4.12
release-notes
-
github.com
/symfony/symfony/releases/tag/v8.0.12
release-notes
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/lox24-notifier/CVE-2026-45754.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/mailjet-mailer/CVE-2026-45754.yaml
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45754.yaml
web
-
github.com
/symfony/symfony
package
-
symfony.com
/cve-2026-45754
web
Sources
- CVE List CVE-2026-45754
- GitHub Advisory GHSA-64hg-93w9-fc35
- NVD CVE-2026-45754
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.