Medium, CVSS 4.6PackagistPublished
Symfony: Twilio SMS Notifier allows unauthenticated webhook injection due to missing X-Twilio-Signature verification
CVE-2026-47212 · GHSA-55rj-x2vc-4whq
- Affected
- Packagist symfony/twilio-notifier >= 6.4.0, < 6.4.40; >= 7.0.0, < 7.4.12; >= 8.0.0, < 8.0.12
- Fixed in
- 8.0.127.4.126.4.40· Vendor fix available
- Issue
- The Twilio SMS notifier bridge ships a webhook request parser used to authenticate and decode the status callbacks Twilio POSTs to an application's webhook endpoint. Its doParse(Request $request, #[\SensitiveParameter] string $secret) method receives the configured webhook secret but never reads it; it decodes and returns the payload unconditionally, ignoring the X-Twilio-Signature HMAC header Twilio sends with each request. As a result, an application that wires up the Twilio webhook endpoint accepts any POST to that URL, even when a signing secret is configured (the recommended setup). An attacker who knows the endpoint exists can submit forged status payloads, fake delivered / failed / undelivered events, leading to delivery-metrics fraud, downstream automation triggers, etc. Resolution TwilioRequestParser::doParse() now requires and verifies the X-Twilio-Signature header (HMAC-SHA1 over the full request URL concatenated with the alphabetically-sorted POST parameters,…
Recommended action: Upgrade to 8.0.12, 7.4.12 or 6.4.40 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.