Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/mailomat-mailer | composer | >= 7.2.0, < 7.4.13 | 7.4.13 |
| symfony/mailomat-mailer | composer | >= 8.0.0, < 8.0.13 | 8.0.13 |
| symfony/symfony | composer | >= 7.2.0, < 7.4.13 | 7.4.13 |
| symfony/symfony | composer | >= 8.0.0, < 8.0.13 | 8.0.13 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the Symfony\Component\Mailer\Bridge\Mailomat\Webhook\MailomatRequestParser::validateSignature function. The security advisory and the provided patch clearly indicate that the function used a user-controllable algorithm from the X-MOM-Webhook-Signature header to verify the webhook signature. The vulnerable code, hash_hmac($algo, $data, $secret), takes the $algo variable directly from the request header. An attacker could provide a weaker algorithm like 'md5' to bypass the signature check. The patch rectifies this by hardcoding the algorithm to 'sha256' (hash_hmac('sha256', $data, $secret)) and ensuring the header specifies 'sha256', thus preventing the algorithm downgrade attack.
Symfony\Component\Mailer\Bridge\Mailomat\Webhook\MailomatRequestParser::validateSignaturesrc/Symfony/Component/Mailer/Bridge/Mailomat/Webhook/MailomatRequestParser.php