CVE-2026-47212CWE-306CWE-347

Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection

Medium · published July 14, 2026

CVSS v4.0
6.9
EPSS
2%
Percentile
74.2
In the wild
Unconfirmed
What it is

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inject forged Twilio status payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.01506 · 74.2th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-07-14T19:00Z
EPSS history
Timeline
  • 14 JUL 19:00Z
    Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection
    cvelistv5