Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

pytonapi

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5PyPIPublished

    pytonapi has a Webhook Custom Path Authentication Bypass

    CVE-2026-54635 · GHSA-3fcr-jvgp-7f58

    Affected
    • PyPI pytonapi >= 2.0.0, < 2.2.1
    Fixed in
    2.2.1· Vendor fix available
    Issue
    Webhook Custom Path Authentication Bypass in pytonapi Summary TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup(), bearer tokens are stored only under the default suffix paths (e.g., /hook/account-tx), but the custom path (e.g., /hook/custom) is never added to the token map. When an incoming request arrives at the custom path, self.tokens.get(path) returns None, causing the if expectedtoken is not None guard to evaluate to False and silently skip authentication entirely. An unauthenticated remote attacker can POST arbitrary forged payloads to the custom webhook endpoint and trigger victim-defined handlers with full integrity impact. Details The vulnerability is a fail-open authentication check in pytonapi/webhook/dispatcher.py. Token registration (setup) stores tokens only under default suffix paths: Handler registration preserves the custom path in the handler…

    Recommended action: Upgrade to 2.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →