Improper Authorization in Python SDK for TONAPI - TonapiWebhookDispatcher

CVE-2026-54635

What is CVE-2026-54635?

A vulnerability has been identified in the pytonapi, a Python SDK for interfacing with the TONAPI that allows for webhook access to the TON blockchain. The issue lies within TonapiWebhookDispatcher, which fails to validate the Authorization header when a webhook handler is registered with a specified path argument. When an attacker registers their handler, the setup() function only stores bearer tokens under default suffix paths and neglects to account for custom paths. This oversight leads to the authentication mechanism being bypassed, enabling unauthenticated remote attackers to send forged payloads to custom webhook endpoints. As a result, this could cause unauthorized access and operation of victim-defined handlers. The vulnerability is addressed in version 2.2.1 of the pytonapi.

References