Executive brief
A vulnerability in the Symfony web framework's Mailtrap integration allows attackers to send fake email event notifications to an application. By bypassing security signature checks, an attacker can forge events such as email bounces, opens, or spam reports. This can lead to corrupted delivery metrics and the incorrect blocking of legitimate email addresses in an organization's mailing lists.
Technical details
The MailtrapRequestParser::doParse() method in Symfony's Mailtrap mailer bridge receives a configured webhook secret but fails to utilize it for signature verification. Specifically, the component ignores the X-Mt-Signature HMAC-SHA256 header provided by Mailtrap, processing the POST payload unconditionally. This allows a remote, unauthenticated attacker to submit forged JSON payloads representing delivery, bounce, open, click, or spam events. The vulnerability is classified under CWE-306 (Missing Authentication) and CWE-347 (Improper Verification of Cryptographic Signature). The issue is resolved in versions 7.4.12 and 8.0.12 by enforcing constant-time HMAC verification when a secret is configured.
Affected products
- Symfony symfony/mailtrap-mailer >= 7.2.0, < 7.4.12; >= 8.0.0, < 8.0.12
- Symfony symfony/symfony >= 7.2.0, < 7.4.12; >= 8.0.0, < 8.0.12
Timeline
- 2026-05-20: patched: Fixes released in versions 7.4.12 and 8.0.12
- 2026-05-20: advisory: GitHub Security Advisory GHSA-59f3-vp2f-mp9w published
- 2026-07-14: disclosed: CVE-2026-45755 published to NVD