Executive brief
The AxonFlow SDK for Java did not expose the HMAC-SHA256 signing key needed to verify incoming webhook deliveries, leaving applications unable to authenticate the source of webhook events. An attacker who discovers the webhook URL could forge fake webhook payloads (e.g., simulated approvals or policy decisions) that the receiving application would accept as legitimate, potentially leading to unauthorized actions or fraudulent transactions.
Technical details
The AxonFlow SDK's WebhookSubscription response type did not expose the HMAC-SHA256 signing key returned by the CreateWebhook endpoint. This cryptographic signature verification defect (CWE-345, CWE-347) prevented developers from authenticating incoming webhook deliveries using the typed SDK API. Callers either had to skip signature verification entirely (accepting any HTTP POST to the webhook URL from any source) or hand-parse the raw JSON response to extract the secret, bypassing type safety. The attack vector is network-based; an attacker needs only knowledge of the webhook URL and can forge HMAC signatures indistinguishable from legitimate platform deliveries. No authentication or user interaction is required. Patched in version 7.0.0, which now exposes the signing key on the CreateWebhook response, allowing applications to validate incoming payloads via constant-time comparison of HMAC-SHA256(secret, raw_body) against the X-AxonFlow-Signature header.
Affected products
- AxonFlow axonflow-sdk-java < 7.0.0
Timeline
- 2026-05-06: disclosed
- 2026-05-06: patched: Version 7.0.0 released with signing key exposure on WebhookSubscription type