CVE-2026-112043

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass...

CVE-2026-112043 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass...

CVE-2026-112043 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass...

CVE-2026-112043

A vulnerability exists in calcom cal.com and cal.diy versions up to 6.2.0 . The issue is located in the Webhook Handler component, specifically within the createWebhookProcedure function in packages/trpc/server/routers/viewer/webhook/util.ts. By manipulating the ID argument , an attacker can achi...

EUVD-2026-104051

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass...

CVE-2026-112043: Authorization Bypass Through User-Controlled Key

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass...

CVE-2026-103245

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

CVE-2026-103245

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

CVE-2026-103245: Improper Verification of Cryptographic Signature

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

PT-2026-103778

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Webflow Trigger node webhook handler. Unauthenticated attackers can send forged webhook requests with attacker-controlled payloads to trigger workflows and...

PT-2026-95797

Name of the Vulnerable Software and Affected Versions Payment Gateway of Stripe for WooCommerce versions prior to 5.0.9 Description Improper Verification of Cryptographic Signature occurs due to the woocommerce api wt stripe webhook endpoint EH Stripe Webhook Handler::handle failing to execute th...

EUVD-2026-77599

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot webhook handlers verify HMAC signatures only when WHATSAPPAPPSECRET or LINEARWEBHOOKSECRET is configured and otherwise parse and dispatch unsigned request bodies. A remote unauthenticated client that reaches the...

CVE-2026-73314: Improper Check for Unusual or Exceptional Conditions

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported authalgo header value. When the algorithm cannot be mapped to a...

CVE-2026-73315: Server-Side Request Forgery (SSRF)

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

CVE-2026-86486

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...

CVE-2026-86486: Missing Authentication for Critical Function

In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank...

CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

CVE-2026-64868

New API (github.com/QuantumNous/new-api) versions before v1.0.0-rc.11 read and log full request bodies on unauthenticated payment webhook endpoints (Stripe, Creem, Waffo) before signature validation. An unauthenticated remote attacker can send oversized payloads to cause memory pressure, containe...

CVE-2026-74244

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...

CVE-2026-74244: Improper Verification of Cryptographic Signature

A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Successful exploitation can lead to th...