CVE-2026-54635 in tonapi
Summary
by MITRE • 07/28/2026
pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with the documented path argument, because setup() stores bearer tokens only under the default suffix paths and never adds the custom path to the token map, so self._tokens.get(path) returns None and the authentication guard is skipped. An unauthenticated remote attacker can POST forged payloads to the custom webhook endpoint and trigger victim-defined handlers. This issue is fixed in version 2.2.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability exists within the TonapiWebhookDispatcher component of the pythonapi SDK for TONAPI, specifically affecting versions between 2.0.0 and 2.2.0. This represents a critical authentication bypass flaw that undermines the security of webhook endpoints designed to receive blockchain events. The issue stems from improper handling of authorization headers when custom paths are registered for webhook handlers, creating a dangerous condition where malicious actors can forge payloads to trigger legitimate webhook processing functions.
The technical root cause lies in how the setup() method manages bearer token storage within the internal _tokens dictionary. When webhook handlers are registered with custom path arguments, the system only stores authentication tokens under default suffix paths and completely neglects to map these tokens to their corresponding custom endpoints. This design flaw creates a mismatch between token validation logic and actual token storage, as the self._tokens.get(path) lookup consistently returns None for custom paths. The authentication guard mechanism fails because it cannot retrieve the appropriate bearer token for verification, effectively disabling access control enforcement for custom webhook endpoints.
This vulnerability has significant operational implications for systems relying on TONAPI webhooks for blockchain event processing. An unauthenticated remote attacker can exploit this flaw by sending forged POST requests to custom webhook endpoints, potentially triggering arbitrary code execution within the victim's handler functions. The impact extends beyond simple unauthorized access, as attackers could manipulate blockchain event processing workflows, potentially leading to financial loss or system compromise when malicious payloads are processed through legitimate webhook handlers. The vulnerability affects any application using pythonapi versions 2.0.0 through 2.2.0 that implement custom webhook paths, making it particularly concerning for production environments.
The security implications align with CWE-287 which addresses improper authentication issues in software systems. This vulnerability also maps to ATT&CK technique T1078.004 which covers legitimate credentials, as the flaw allows unauthorized actors to effectively bypass authentication mechanisms using forged requests. The remediation requires updating to version 2.2.1 where proper token mapping for custom paths has been implemented. Organizations should immediately upgrade their pythonapi dependencies and review all webhook endpoint configurations to ensure that custom path registrations properly implement authentication. Security teams should also monitor for potential exploitation attempts and consider implementing additional request validation layers as defensive measures against similar issues in other components.
The vulnerability demonstrates a classic case of incomplete input validation and improper state management in API security implementations. The failure to maintain consistent token mapping across all registered paths represents a fundamental flaw in the authorization system design. This issue highlights the importance of thorough testing for edge cases in security-sensitive components, particularly when dealing with configurable endpoints that may have varying path structures. The fix in version 2.2.1 addresses this by ensuring proper token storage and retrieval mechanisms for both default and custom paths, restoring the intended authentication controls that protect webhook processing functions from unauthorized access attempts.