Skip to content
CVE PROGRAM SOURCE RECORD6.3 Medium

CVE-2026-48747

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

symfony symfony

  • >= 7.2.0, < 7.4.12affected
  • >= 8.0.0-BETA1, < 8.0.13affected

symfony mailomat-mailer

  • >= 7.2.0, < 7.4.12affected
  • >= 8.0.0-BETA1, < 8.0.13affected

References