A security vulnerability (CVE-2026-45754) was discovered in Symfony's Mailjet Mailer and LOX24 Notifier webhook parsers. Both parsers accept a webhook secret parameter in their `doParse()` methods but never actually validate it, meaning any POST request to the webhook endpoint is accepted unconditionally — even when a secret is configured. This allows attackers to inject forged webhook events, potentially corrupting suppression lists or faking delivery metrics. The fix adds proper constant-time secret verification: Mailjet now checks HTTP Basic credentials, and LOX24 checks an `X-LOX24-Token` header. Affected versions are Symfony >=6.4 <6.4.40, >=7.0 <7.4.12, and >=8.0 <8.0.12, with patches available in 6.4.40, 7.4.12, and 8.0.12.
492 Impressions