CVE-2026-47769

Name of the Vulnerable Software and Affected Versions APIFold versions prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5

Description The /webhooks/:serverSlug/:eventName endpoint accepts unauthenticated JSON and stores it in Redis and the webhook events PostgreSQL table without requiring authentication or signature checks. This occurs because the createWebhookRouter function is called without a validators map, causing the signature-validation block in receivers.ts to be skipped. An unauthenticated client with a valid serverSlug can inject arbitrary payloads that are then served as trusted resource state to legitimate MCP clients.

Recommendations Update to the version containing commit 7f19b52280f414f57af2b79a95333d1c8fbeece5.