CVE-2026-54635

CVE-2026-54635 affects pytonapi 2.0.0–2.2.0, where TonapiWebhookDispatcher fails to validate the Authorization header for webhook handlers registered with a documented path (custom path). The setup() logic only stores bearer tokens for default suffix paths, so self._tokens.get(path) returns None ...