CVE-2026-121545

Dreeve versions prior to 5.8.0 are vulnerable to a missing authentication flaw in the StravaWebhookRequestHandler::handleEvent component. The root cause is the failure to perform necessary signature , verify-token , or owner_id checks. This allows unauthenticated attackers to forge Strava webhook...