{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/pytonapi-project/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pytonapi (\u003c 2.2.1)"],"_cs_severities":["high"],"_cs_tags":["authentication-bypass","webhooks","python"],"_cs_type":"advisory","_cs_vendors":["pytonapi Project"],"content_html":"\u003cp\u003eThe \u003ccode\u003epytonapi\u003c/code\u003e library, specifically version 2.2.0, is affected by an authentication bypass vulnerability, identified as GHSA-3fcr-jvgp-7f58. The \u003ccode\u003eTonapiWebhookDispatcher\u003c/code\u003e component fails to properly validate the \u003ccode\u003eAuthorization\u003c/code\u003e header when a webhook handler is configured using the documented \u003ccode\u003epath=\u003c/code\u003e argument, creating a custom endpoint. During setup, bearer tokens are only associated with default suffix paths, leaving custom paths without a corresponding token entry. Consequently, when an incoming request targets a custom path, the system's authentication check is silently bypassed as \u003ccode\u003eexpected_token\u003c/code\u003e evaluates to \u003ccode\u003eNone\u003c/code\u003e. This \u0026quot;fail-open\u0026quot; mechanism allows an unauthenticated remote attacker to send forged JSON payloads to these custom webhook endpoints. This can trigger victim-defined business logic, such as payment processing or account state updates, with attacker-controlled data, leading to severe integrity impact and potential financial or operational harm. Any application integrating this specific version of \u003ccode\u003epytonapi\u003c/code\u003e and utilizing custom webhook paths is vulnerable.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eAttacker Reconnaissance\u003c/strong\u003e: An attacker identifies a target application utilizing \u003ccode\u003epytonapi\u003c/code\u003e with \u003ccode\u003eTonapiWebhookDispatcher\u003c/code\u003e configured to use a custom webhook path (e.g., \u003ccode\u003e/hook/custom\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePayload Crafting\u003c/strong\u003e: The attacker constructs a malicious JSON payload designed to mimic a legitimate \u003ccode\u003epytonapi\u003c/code\u003e webhook event (e.g., an \u003ccode\u003eaccount_tx\u003c/code\u003e notification) but containing forged data (e.g., a \u003ccode\u003eFORGED_TX_HASH\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExploitation Attempt\u003c/strong\u003e: The attacker sends an unauthenticated HTTP POST request to the application's custom webhook endpoint (e.g., \u003ccode\u003ehttps://victim.example/hook/custom\u003c/code\u003e), embedding the forged JSON payload in the request body. The \u003ccode\u003eAuthorization\u003c/code\u003e header is either omitted or contains an incorrect bearer token.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerability Trigger\u003c/strong\u003e: The \u003ccode\u003epytonapi\u003c/code\u003e \u003ccode\u003eTonapiWebhookDispatcher\u003c/code\u003e instance receives the incoming HTTP request. When processing the request for the custom path, the dispatcher attempts to retrieve an \u003ccode\u003eexpected_token\u003c/code\u003e from its internal map using \u003ccode\u003eself._tokens.get(path)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthentication Bypass\u003c/strong\u003e: Because custom paths are never registered in \u003ccode\u003e_tokens\u003c/code\u003e, the \u003ccode\u003eexpected_token\u003c/code\u003e variable becomes \u003ccode\u003eNone\u003c/code\u003e. This causes the subsequent authentication check \u003ccode\u003eif expected_token is not None\u003c/code\u003e to evaluate to \u003ccode\u003eFalse\u003c/code\u003e, silently bypassing the entire authentication mechanism.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePayload Processing\u003c/strong\u003e: The dispatcher proceeds to parse the attacker's forged JSON payload as if it were a legitimate and authenticated webhook event.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact Delivery\u003c/strong\u003e: The victim-defined asynchronous event handler (e.g., \u003ccode\u003eon_custom_tx\u003c/code\u003e) associated with the custom path is invoked by the dispatcher, receiving and processing the attacker-controlled forged data.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAdverse Action\u003c/strong\u003e: The victim's application executes its business logic (e.g., updating account balances, initiating payments, dispatching notifications) based on the attacker's forged information, leading to financial loss, data corruption, or other integrity compromises.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability, classified as Improper Authentication (CWE-287), critically impacts the integrity of applications using \u003ccode\u003epytonapi\u003c/code\u003e version 2.2.0 that have registered webhook handlers with the \u003ccode\u003epath=\u003c/code\u003e argument. There is no specific number of victims or sectors identified, but any application meeting these criteria is fully exposed. A successful exploitation allows an unauthenticated remote attacker to inject arbitrary, forged TON blockchain event data, directly triggering and manipulating victim-defined business logic. This can lead to severe consequences such as fraudulent payment processing, incorrect account state updates, or the dispatch of misleading notifications, resulting in financial losses or operational disruption. Confidentiality is not directly affected, but data integrity and the reliability of automated processes are significantly compromised.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003epytonapi\u003c/code\u003e to a patched version greater than 2.2.0 to resolve the GHSA-3fcr-jvgp-7f58 authentication bypass.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Successful POST to pytonapi Custom Webhook Path (GHSA-3fcr-jvgp-7f58)\u0026quot; to your SIEM solution to identify potential exploitation attempts against vulnerable \u003ccode\u003epytonapi\u003c/code\u003e applications.\u003c/li\u003e\n\u003cli\u003eReview webserver access logs for \u003ccode\u003ewebserver\u003c/code\u003e entries indicating successful (HTTP 200 OK) POST requests to custom webhook paths (e.g., \u003ccode\u003e/hook/custom\u003c/code\u003e) that lack expected authentication headers or originate from unexpected sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T17:10:00Z","date_published":"2026-07-28T17:10:00Z","id":"https://feed.craftedsignal.io/briefs/2026-07-pytonapi-webhook-auth-bypass/","summary":"The pytonapi library, specifically version 2.2.0, contains an authentication bypass vulnerability (GHSA-3fcr-jvgp-7f58) in its TonapiWebhookDispatcher, allowing unauthenticated remote attackers to send forged payloads to custom webhook endpoints, triggering victim-defined business logic and causing integrity impact.","title":"pytonapi Webhook Custom Path Authentication Bypass (GHSA-3fcr-jvgp-7f58)","url":"https://feed.craftedsignal.io/briefs/2026-07-pytonapi-webhook-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Pytonapi Project","version":"https://jsonfeed.org/version/1.1"}