PT-2026-65546 · Pypi · Pytonapi

CVE-2026-54635 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions pytonapi versions 2.0.0 through 2.2.0

Description TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered using the path argument. During the setup() process, bearer tokens are only stored under default suffix paths, meaning custom paths are never added to the token map. Consequently, when a request is sent to a custom path, the authentication guard is skipped because the expected token is not found. This allows an unauthenticated remote attacker to send forged payloads to the custom webhook endpoint and trigger victim-defined handlers, potentially impacting the integrity of business logic such as payment processing or account state updates.

Recommendations Update pytonapi to version 2.2.1. As a temporary workaround, avoid using the path argument when registering webhook handlers until the update is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-54635

GHSA-3FCR-JVGP-7F58

Affected Products

Pytonapi

References · 7

• 🔥 https://github.com/nessshon/tonapi/security/advisories/GHSA-3fcr-jvgp-7f58 · Exploit
• https://osv.dev/vulnerability/GHSA-3fcr-jvgp-7f58 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54635 · Security Note
• https://github.com/nessshon/tonapi/commit/854222b7ee68d3fb7b4d6d899d200f388483bd86 · Note
• https://github.com/nessshon/tonapi/releases/tag/v2.2.1 · Note
• cvss:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · Note
• https://github.com/nessshon/tonapi · Note