CVE-2026-121620

The coopcycle-web software versions 5.6.0 before 6.20.0 is vulnerable to a missing authentication flaw. The root cause is that the x-zelty-hmac-sha256 HMAC signature is never verified, allowing unauthenticated attackers to forge Zelty webhook events . Attackers can send forged POST requests to th...