GHSA-248h-974q-xrc2
Medium · 5.9axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
CVSS
5.9
EPSS
—
Published
May 6, 2026
CISA due date
—
The record
The AxonFlow SDK's `WebhookSubscription` (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform's `CreateWebhook` endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the `X-AxonFlow-Signature` header on incoming webhook deliveries. Affected callers had two unsatisfactory options: 1. Skip signature verification entirely — accepting any payload from any source that knew the webhook URL. 2. Hand-parse the raw HTTP JSON response to extract the secret, bypassing the type-safe SDK surface. This advisory is filed across all four AxonFlow SDKs (Go, Python, TypeScript, Java) because the same defect and the same fix landed in each.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-102682 Pipecat is an open-source Python framework for building real-time voice and multimodal… CWE-345
- CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-345
- CVE-2026-102275 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
- CVE-2026-102267 PyJWT is a Python implementation of JSON Web Token standards. CWE-345
- CVE-2026-19941 An inapplicable NSEC record may be accepted by a `named` resolver as proof that no… CWE-345
- CVE-2026-77955 In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD… CWE-345
- CVE-2026-89251 AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad… CWE-345
- CVE-2026-86809 The Persian Elementor WordPress plugin from 2.7.10 before 2.8.2 does not verify that the… CWE-345