Packagist/symfony/symfony CVE-2026-45754: medium

Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Action: Upgrade symfony/symfony to 6.4.40 or later.

composer require symfony/symfony:6.4.40

composer require symfony/symfony:7.4.12

composer require symfony/symfony:8.0.12

Affected

Fixed versions

Sources

• osv: GHSA-64hg-93w9-fc35#Packagist/symfony/symfony
• https://github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35
• https://github.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/lox24-notifier/CVE-2026-45754.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mailjet-mailer/CVE-2026-45754.yaml
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2026-45754.yaml
• https://github.com/symfony/symfony
• https://symfony.com/cve-2026-45754

CVE-2026-45754 · published 2026-05-28T17:22:36Z · modified 2026-09-10T03:50:45.813658398Z · JSON