CVE-2026-45754: sensiolabs symfony Improper Authentication
Vulnerability summary
CVE-2026-45754 is a medium (CVSS 6.9) Improper Authentication vulnerability in sensiolabs symfony. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.6% of scored vulnerabilities.
Timeline
- 14-07-2026PublishedVulnerability first disclosed.
- 21-07-2026Last modifiedVulnerability information updated.
Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.
CVSS metrics
6 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
0.00 pp
From 0.45% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Symfony3 products
- lox24-notifier≥ 7.1.0-BETA1, < 7.4.12 | ≥ 8.0.0-BETA1, < 8.0.12
- mailjet-mailer≥ 6.4.0, < 6.4.40 | ≥ 7.0.0-BETA1, < 7.4.12 | ≥ 8.0.0-BETA1, < 8.0.12
- symfony≥ 6.4.0, < 6.4.40 | ≥ 7.0.0-BETA1, < 7.4.12 | ≥ 8.0.0-BETA1, < 8.0.12
Debian1 product
- symfony< 6.4.41+dfsg-0+deb13u1 | < 7.4.12+dfsg-1
Sensiolabs1 product
- symfony≥ 6.4.0, < 6.4.40 | ≥ 7.0.0, < 7.4.12 | ≥ 8.0.0, < 8.0.12
Ubuntu1 product
- symfonyAll versions (No fix recorded)
4 vendors · 6 products
References
10 links- github.com/symfony/symfony/security/advisories/GHSA-64hg-93w9-fc35X Refsource CONFIRMPatchVendor Advisory
- symfony.com/blog/…REPORT
