Medium, CVSS 6.6PackagistPublished
Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection
CVE-2026-45755 · GHSA-59f3-vp2f-mp9w
- Affected
- Packagist symfony/mailtrap-mailer >= 7.2.0, < 7.4.12; >= 8.0.0, < 8.0.12
- Fixed in
- 8.0.127.4.12· Vendor fix available
- Issue
- The Mailtrap mailer bridge ships a webhook request parser used to authenticate and decode the event callbacks Mailtrap POSTs to an application's webhook endpoint. Its doParse(Request $request, #[\SensitiveParameter] string $secret) method receives the configured webhook secret but never reads it; it decodes and returns the payload unconditionally, ignoring the X-Mt-Signature HMAC header Mailtrap sends with each request. As a result, an application that wires up the Mailtrap webhook endpoint accepts any POST to that URL, even when a signing secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged event payloads, fake delivery / bounce / open / click / spam events, leading to suppression-list corruption, delivery-metrics fraud, etc. Resolution MailtrapRequestParser::doParse() now requires and verifies the X-Mt-Signature header, an HMAC-SHA256 of the raw request body keyed with the configured secret, before decoding the…
Recommended action: Upgrade to 8.0.12 or 7.4.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.