CVE-2026-54635: Authentication Bypass via Custom Webhook Paths in pytonapi
Vulnerability ID: CVE-2026-54635
CVSS Score: 7.5
Published: 2026-07-28
An authentication bypass vulnerability exists in the pytonapi library when custom paths are registered in the TonapiWebhookDispatcher. The application fails to retrieve or store secure tokens for custom paths, leading to a fail-open authorization check that allows unauthenticated remote attackers to send spoofed webhook events directly to internal handlers.
TL;DR
Unauthenticated remote attackers can bypass webhook authorization and spoof transaction events by exploiting a fail-open design when custom registration paths are configured in the pytonapi dispatcher.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-287 (Improper Authentication)
- Attack Vector: Network
- CVSS v3.1 Score: 7.5 (High)
- Impact: High Integrity Compromise
- Exploit Status: PoC Available
- KEV Status: Not Listed
Affected Systems
- pytonapi Webhook Dispatcher Component
-
pytonapi: >= 2.0.0, < 2.2.1 (Fixed in:
2.2.1)
Code Analysis
Commit: 854222b
Fix webhook path setup and token validation for custom paths
Exploit Details
- GitHub: Official Proof-of-Concept code and technical analysis in advisory.
Mitigation Strategies
- Upgrade pytonapi dependency to version 2.2.1 or newer.
- Remove the custom 'path' argument in handler registrations to fall back to safe default suffixes.
- Implement source IP restriction at the firewall or reverse proxy level to only allow legitimate TONAPI servers.
Remediation Steps:
- Execute 'pip install --upgrade pytonapi>=2.2.1' in the target environment.
- Inspect source code for occurrences of @dispatcher.account_tx with a custom path argument.
- Deploy the updated application and monitor log endpoints for unauthorized access attempts.
References
Read the full report for CVE-2026-54635 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)