PT-2026-45034 · Symfony · Symfony

Published 2026-05-21 · Updated 2026-05-29 · CVE-2026-47212

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 6.4.11

Description The Twilio SMS notifier bridge contains a webhook request parser used to authenticate and decode status callbacks. The doParse(Request $request, #[SensitiveParameter] string $secret) function receives a configured webhook secret but fails to read or verify it, ignoring the X-Twilio-Signature HMAC header. This allows an attacker to submit forged POST requests to the webhook endpoint, even when a signing secret is configured, potentially leading to delivery-metrics fraud or unauthorized downstream automation triggers.

Recommendations Update to version 6.4.11 or later. For applications behind a TLS-terminating reverse proxy, configure framework.trusted proxies and framework.trusted headers to ensure Request::getUri() returns the public URL signed by Twilio.

Exploit

Fix

Missing Authentication

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-306

CWE-347

Related Identifiers

CVE-2026-47212

GHSA-55RJ-X2VC-4WHQ

Affected Products

Symfony

References · 13

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-47212.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/twilio-notifier/CVE-2026-47212.yaml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2026-47212 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47212 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47212 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-55rj-x2vc-4whq · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-47212 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-47212 · Vendor Advisory
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/commit/8545fb2af6c07dfb5ef0fc8d9bccf86db2c94356 · Note
• https://github.com/symfony/symfony/security/advisories/GHSA-55rj-x2vc-4whq · Note
• https://symfony.com/cve-2026-47212 · Note
• https://symfony.com/blog/cve-2026-47212-twilio-notifier-webhook-parser-never-verifies-the-x-twilio-signature-hmac-unauthenticated-webhook-event-injection · Note