PT-2026-44547 · Mailtrap · Mailtrap Mailer Bridge

Published 2026-05-21 · Updated 2026-05-29 · CVE-2026-45755

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Mailtrap mailer bridge versions prior to 7.4

Description The webhook request parser used to authenticate and decode event callbacks fails to verify the X-Mt-Signature HMAC header. Specifically, the doParse(Request $request, #[SensitiveParameter] string $secret) function receives the configured webhook secret but does not utilize it, returning the payload unconditionally. This allows an attacker to submit forged event payloads to the webhook endpoint, potentially leading to delivery-metrics fraud and suppression-list corruption.

Recommendations Update to version 7.4 or later to ensure the doParse() function verifies the X-Mt-Signature header using a constant-time comparison.

Exploit

Fix

Missing Authentication

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-306

CWE-347

Related Identifiers

CVE-2026-45755

GHSA-59F3-VP2F-MP9W

Affected Products

Mailtrap Mailer Bridge

References · 17

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45755.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailtrap-mailer/CVE-2026-45755.yaml · Exploit
• https://cve.org/CVERecord?id=CVE-2026-45755 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-45755 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45755 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-59f3-vp2f-mp9w · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-45755 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-45755 · Vendor Advisory
• https://github.com/symfony/symfony/commit/4e0467e4e182cf2e704a3d9e1bc1a6be65d52ab8 · Note
• https://github.com/symfony/symfony/security/advisories/GHSA-59f3-vp2f-mp9w · Note
• https://github.com/symfony/symfony · Note
• https://reddit.com/r/VulnMatter/comments/1tqmcvv/resumen_diario_de_vulnerabilidades_29052026 · Reddit Post
• https://symfony.com/blog/cve-2026-45755-mailtrap-mailer-webhook-parser-never-verifies-the-x-mt-signature-hmac-unauthenticated-webhook-event-injection · Note
• https://reddit.com/r/VulnMatter/comments/1tr3s9r/resumen_diario_de_vulnerabilidades_29052026 · Reddit Post
• https://symfony.com/cve-2026-45755 · Note