CVE-2026-121545

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

EUVD-2026-115890

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...

CVE-2026-121545

Dreeve versions prior to 5.8.0 are vulnerable to a missing authentication flaw in the StravaWebhookRequestHandler::handleEvent component. The root cause is the failure to perform necessary signature , verify-token , or owner_id checks. This allows unauthenticated attackers to forge Strava webhook...

CVE-2026-121545: robiningelbrecht dreeve: Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that…

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...