AIKIDO-2026-10875
symfony/lox24-notifier is vulnerable to Improper Authentication
65
Medium Risk
This Affects:
symfony/lox24-notifierTL;DR
Symfony webhook parsers receive configured provider secrets but do not enforce the expected webhook authentication. A forged POST to an application webhook endpoint is decoded and accepted as a provider event. Pre-fix applications can process fake delivery, bounce, spam, click, or status events. The fix requires provider-specific credentials or tokens before accepting the webhook.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
symfony/lox24-notifier is vulnerable to Improper Authentication in versions 7.1.0 - 7.4.11 and 8.0.0 - 8.0.11.
How to fix this
Upgrade the symfony/lox24-notifier library to the patch version.
Links
GitHub Releases
github.com/symfony/lox24-notifier/releases/tag/v8.0.12github.com/symfony/symfony/releases/tag/v6.4.40github.com/symfony/symfony/releases/tag/v7.4.12github.com/symfony/symfony/releases/tag/v8.0.12Fix Commits
github.com/symfony/symfony/commit/3e52bf5ab733ee32e35eeeeb2631d859c941838egithub.com/symfony/symfony/commit/4aaa45dd054f73445f1ab254968b7e60b546cc77
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.