/mailtrap-mailer vulnerabilities

🔔 Create alert RSS

Published CVEs affecting /mailtrap-mailer products: 1 record(s), with severity, exploitation and fixes.

Mailtrap-mailer 1

Exploited only (KEV) →

CVE-2026-45755 Medium · 5.3 CWE-306 Jul 14, 2026

Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.