Arbitrary JSON Injection in APIFold OpenAPI Server Endpoint

CVE-2026-47769

What is CVE-2026-47769?

APIFold's design flaw permits unauthenticated clients to inject arbitrary JSON data into the server via the /webhooks/:serverSlug/:eventName endpoint. This vulnerability arises from the lack of signature validation and authentication, leading to potential malicious data being stored in Redis and PostgreSQL without checks. The issue was rectified in a later commit, but prior to this fix, any network client with knowledge of a valid server slug could exploit the vulnerability to inject harmful payloads, compromising the integrity of trusted resource states served to legitimate clients.

References