Executive brief
The AxonFlow SDK for TypeScript did not expose the cryptographic signing key needed to verify incoming webhook deliveries from the AxonFlow platform. Without this key, developers could not authenticate webhook messages, forcing them to either skip verification or bypass the SDK's type-safe interface. An attacker who discovered a webhook URL could send forged webhook events that appear legitimate, potentially causing the application to execute unauthorized actions such as simulating approval callbacks or policy decisions.
Technical details
This vulnerability is an insufficient cryptographic signature verification issue (CWE-345, CWE-347). The WebhookSubscription type returned by the SDK's CreateWebhook endpoint did not expose the HMAC-SHA256 signing key, preventing callers from validating the X-AxonFlow-Signature header on incoming webhook deliveries. An attacker with knowledge of the webhook URL—obtainable through misconfiguration, log leakage, or network traffic inspection—could craft and send fraudulent webhook payloads that the receiving application would process as authentic. The attack requires high attack complexity due to the need to discover the webhook URL, but succeeds without authentication or user interaction. Patched in version 7.0.0, which exposes the signing key on the WebhookSubscription response type.
Affected products
- AxonFlow SDK TypeScript < 7.0.0
Timeline
- 2026-05-06: disclosed: Published on GitHub advisory database
- 2026-05-06: patched: Patched in version 7.0.0