CVE-2026-47212: Symfony Twilio SMS Notifier Unauthenticated Webhook Injection Vulnerability
Summary
CVE-2026-47212: Description The Twilio SMS notifier bridge ships a webhook request parser used to authenticate and decode the status callbacks Twilio POSTs to an application's webhook endpoint. Affects symfony/symfony across 3 version ranges.
>= 6.4.0, < 6.4.40
>= 7.0.0, < 7.4.12
>= 8.0.0, < 8.0.12
Fixed in 6.4.40, 7.4.12 or 8.0.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework used for building web applications. It provides a robust set of tools and libraries to facilitate rapid development. The Twilio SMS Notifier is a bridge within Symfony that allows applications to send SMS notifications via Twilio's API. This component is designed to handle webhook requests from Twilio, which inform the application about the status of sent messages. However, a critical vulnerability has been identified that compromises the security of this integration.
Vulnerability Detail
The vulnerability arises from the Twilio SMS notifier bridge's webhook request parser, specifically in its doParse method. This method is supposed to authenticate incoming requests using a configured webhook secret but fails to do so. It does not verify the X-Twilio-Signature HMAC header sent by Twilio, allowing any POST request to be accepted by the application. This oversight can lead to unauthorized users submitting forged status payloads, resulting in delivery-metrics fraud and triggering downstream automation processes without proper validation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.4.0, < 6.4.406.4.40composer require symfony/symfony:6.4.40 -
>= 7.0.0, < 7.4.127.4.12composer require symfony/symfony:7.4.12 -
>= 8.0.0, < 8.0.128.0.12composer require symfony/symfony:8.0.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update to the patched version, consider implementing a temporary workaround by manually verifying the X-Twilio-Signature header in your webhook handling code. Here is an example of how to do this in PHP:
if (isset($_SERVER['HTTP_X_TWILIO_SIGNATURE'])) {
$signature = $_SERVER['HTTP_X_TWILIO_SIGNATURE'];
// Your logic to verify the signature against the payload
// Reject the request if the signature does not match
} else {
// Reject the request as it lacks the required signature
}
Conclusion
The Symfony Twilio SMS Notifier vulnerability (CVE-2026-47212) poses a significant risk due to its lack of proper webhook signature verification. It is crucial for developers using this component to update to the latest patched versions to secure their applications against potential exploitation.
See every vulnerability recorded for symfony/symfony →
FAQ
CVE-2026-47212 is a vulnerability in the Symfony Twilio SMS Notifier that allows unauthenticated webhook injection due to missing signature verification.
If your application uses the Twilio SMS Notifier without proper signature verification, it may accept forged webhook requests, leading to potential fraud and automation issues.
You should update your Symfony package to the latest patched version as soon as possible to mitigate the risk.
You can use Vulert, which monitors open-source vulnerabilities in your software using the composer.lock file. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 4.6, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/symfony.
