CVE-2026-45754: Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 39% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

LO

lox24-notifier · symfony

>= 7.1.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 · source: vendor

MA

mailjet-mailer · symfony

>= 6.4.0, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 · source: vendor

SY

symfony · symfony

>= 6.4.0, < 6.4.40; >= 7.0.0-BETA1, < 7.4.12; >= 8.0.0-BETA1, < 8.0.12 · source: vendor, NVD