CVE-2026-48747: Mailomat Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade (Symfony Blog)

A security advisory for Symfony's Mailomat Mailer component (CVE-2026-48747) discloses a signature algorithm downgrade vulnerability. The webhook parser read the HMAC algorithm directly from the incoming request header (e.g., `algo=signature`) and passed it to PHP's `hash_hmac()` without validation, allowing an attacker to substitute weaker algorithms like MD4 or MD5. This is analogous to the JWT `alg=none` downgrade attack. The fix in Symfony 7.4.13 and 8.0.13 enforces that only `sha256=<hex>` is accepted, using constant-time comparison with HMAC-SHA256.