PT-2026-44546 · Symfony · Symfony Webhook Bridges

Published 2026-05-21 · Updated 2026-05-28 · CVE-2026-45754

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Symfony Webhook Bridges versions prior to 6.4 Symfony Webhook Bridges versions prior to 7.4

Description The Mailjet mailer bridge and the LOX24 SMS notifier bridge contain webhook request parsers that fail to authenticate event callbacks. The doParse(Request $request, #[SensitiveParameter] string $secret) methods receive a configured webhook secret but do not utilize it, returning the payload unconditionally. This allows an attacker to submit forged event payloads to the webhook endpoint, potentially leading to delivery-metrics fraud or suppression-list corruption.

Recommendations Update to version 6.4 or later to fix the Mailjet bridge by ensuring MailjetRequestParser::doParse() validates HTTP Basic credentials using a constant-time comparison. Update to version 7.4 or later to fix the LOX24 bridge by ensuring Lox24RequestParser::doParse() validates the X-LOX24-Token HTTP header against the configured secret.

Exploit

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2026-45754

GHSA-64HG-93W9-FC35

Affected Products

Symfony Webhook Bridges

References · 16

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/lox24-notifier/CVE-2026-45754.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45754.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailjet-mailer/CVE-2026-45754.yaml · Exploit
• https://ubuntu.com/security/CVE-2026-45754 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-64hg-93w9-fc35 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45754 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45754 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45754 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-45754 · Security Note
• https://github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35 · Note
• https://github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77 · Note
• https://github.com/symfony/symfony · Note
• https://symfony.com/cve-2026-45754 · Note
• https://symfony.com/blog/cve-2026-45754-mailjet-and-lox24-webhook-parsers-never-verify-the-configured-secret-unauthenticated-event-injection · Note
• https://twitter.com/dailycve/status/2060132092739002651 · Twitter Post