CVE-2026-54635
Received Received - Intake

Authentication Bypass in Tonapi Python SDK via Webhook

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: GitHub, Inc.

Description
pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup() stores bearer tokens only under the default suffix paths and never adds the custom path to the token map, so self._tokens.get(path) returns None and the authentication guard is skipped. An unauthenticated remote attacker can POST forged payloads to the custom webhook endpoint and trigger victim-defined handlers. This issue is fixed in version 2.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-54635
EUVD
EUVD-2026-49907

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nessshon pytonapi to 2.2.1 (exc)
nessshon pytonapi 2.2.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-54635 is an authentication bypass vulnerability in pytonapi versions 2.0.0 to 2.2.0. It occurs in the TonapiWebhookDispatcher component when a webhook handler is registered with a custom path. The system fails to validate the Authorization header because bearer tokens are only stored for default paths, not custom ones. This allows unauthenticated attackers to send forged payloads to custom webhook endpoints and trigger victim-defined handlers.

Detection Guidance

Check if your pytonapi version is between 2.0.0 and 2.2.0. Inspect webhook registrations for custom paths and verify if the Authorization header is enforced. Look for unauthorized POST requests to custom webhook endpoints.

Impact Analysis

An unauthenticated remote attacker could exploit this to send arbitrary payloads to custom webhook endpoints. This could lead to unauthorized actions being triggered, data manipulation, or further compromise of systems relying on the webhook handlers. The impact includes high integrity loss as attackers can execute victim-defined handlers without authentication.

Compliance Impact

This vulnerability could lead to unauthorized data access or manipulation, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust due to failed authentication controls.

Mitigation Strategies

Upgrade pytonapi to version 2.2.1 or later. Ensure all webhook handlers use default suffix paths or enforce token validation for custom paths. Review logs for suspicious POST requests to custom endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54635. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart