{"uuid": "377887fe-9ecf-4073-840a-e1624e732fd7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54635", "type": "seen", "source": "https://gist.github.com/alon710/49b30b9938ae88ab2f795a5eb6f5b0cc", "content": "# CVE-2026-54635: CVE-2026-54635: Authentication Bypass via Custom Webhook Paths in pytonapi\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54635\n\n## Summary\nAn authentication bypass vulnerability exists in the pytonapi library when custom paths are registered in the TonapiWebhookDispatcher. The application fails to retrieve or store secure tokens for custom paths, leading to a fail-open authorization check that allows unauthenticated remote attackers to send spoofed webhook events directly to internal handlers.\n\n## TL;DR\nUnauthenticated remote attackers can bypass webhook authorization and spoof transaction events by exploiting a fail-open design when custom registration paths are configured in the pytonapi dispatcher.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-287 (Improper Authentication)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Impact**: High Integrity Compromise\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- pytonapi Webhook Dispatcher Component\n- **pytonapi**: >= 2.0.0, < 2.2.1 (Fixed in: `2.2.1`)\n\n## Mitigation\n\n- Upgrade pytonapi dependency to version 2.2.1 or newer.\n- Remove the custom 'path' argument in handler registrations to fall back to safe default suffixes.\n- Implement source IP restriction at the firewall or reverse proxy level to only allow legitimate TONAPI servers.\n\n**Remediation Steps:**\n1. Execute 'pip install --upgrade pytonapi>=2.2.1' in the target environment.\n2. Inspect source code for occurrences of @dispatcher.account_tx with a custom path argument.\n3. Deploy the updated application and monitor log endpoints for unauthorized access attempts.\n\n## References\n\n- [GitHub Security Advisory GHSA-3fcr-jvgp-7f58](https://github.com/nessshon/tonapi/security/advisories/GHSA-3fcr-jvgp-7f58)\n- [GitHub Patch Commit](https://github.com/nessshon/tonapi/commit/854222b7ee68d3fb7b4d6d899d200f388483bd86)\n- [pytonapi v2.2.1 Release Details](https://github.com/nessshon/tonapi/releases/tag/v2.2.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54635) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-28T18:31:38.114347Z"}