CVE-2026-54635

Name of the Vulnerable Software and Affected Versions pytonapi versions 2.0.0 through 2.2.0

Description TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered using the path argument. During the setup() process, bearer tokens are only stored under default suffix paths, meaning custom paths are never added to the token map. Consequently, when a request is sent to a custom path, the authentication guard is skipped because the expected token is not found. This allows an unauthenticated remote attacker to send forged payloads to the custom webhook endpoint and trigger victim-defined handlers, potentially impacting the integrity of business logic such as payment processing or account state updates.

Recommendations Update pytonapi to version 2.2.1. As a temporary workaround, avoid using the path argument when registering webhook handlers until the update is applied.