CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861 Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

CVE-2026-72861: Improper Verification of Cryptographic Signature

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'string' || await verify...", so when the...

Convex / Appwrite / PocketBase API Enumeration

Enumerates PocketBase /api/collections, Appwrite /v1 databases, and Convex deployments discovered in client bundles. Auto-scrapes credentials when omitted. !/usr/bin/env python3 -- coding: utf-8 -- """ Enumerate Convex, Appwrite, and PocketBase APIs from discovered credentials. Follow-up for...

Appwrite Users Enumeration

Uses leaked Appwrite API keys with project ID to list users and teams via /v1/users. Auto-discovers endpoint, project, and key from bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerate Appwrite users and teams using leaked API keys.""" from kittysploit import from...

Appwrite Login Panel - Detect

Appwrite login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Appwrite login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.osint.faviconhash import shodanmmh3 class ModuleScanner, Httpclient: info = 'name': 'Appwrite...

CVE-2026-27579

CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue...

Exploit for CVE-2026-27579

Appwrite CORS Misconfiguration Exploit PoC CVE-2026-27579...

CVE-2026-27579: Origin Validation Error

CollabPlatform is a full-stack, real-time doc collaboration platform. In all versions of CollabPlatform, the Appwrite project used by the application is misconfigured to allow arbitrary origins in CORS responses while also permitting credentialed requests. An attacker-controlled domain can issue...

CollabPlatform security vulnerabilities

CollabPlatform is a real-time collaboration platform developed by Manav Mahesh Sanger as an individual developer. CollabPlatform has a security vulnerability, which stems from improper CORS configuration in the Appwrite project. This allows credentials from any source to be requested, potentially...

PT-2026-21376

Name of the Vulnerable Software and Affected Versions CollabPlatform affected versions not specified Description The application’s Appwrite project is misconfigured, allowing arbitrary origins in Cross-Origin Resource Sharing CORS responses while also permitting credentialed requests. This allows...

Malicious Package

Overview ansi-universal-ui is a malicious package. This package contains malicious code, and it has been removed from the official package manager. The package sets up a standalone Python runtime and downloads an obfuscated payload from an Appwrite storage bucket that, upon execution, performs an...

EUVD-2022-1199

Malicious code in bioql PyPI...

EUVD-2022-6708

Malicious code in bioql PyPI...

EUVD-2024-16838

Malicious code in bioql PyPI...

CVE-2024-1063

Appwrite = v1.4.13 is affected by a Server-Side Request Forgery SSRF via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CVE-2023-27159...

CVE-2023-50974

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...

CVE-2023-27159

Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery SSRF via the component /v1/avatars/favicon. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request...

CVE-2022-25377

The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. In order to be vulnerable, APPSTORAGECERTIFICATES/.well-known/acme-challenge must exist on disk. This pathname is automatically created if...