Executive brief
APIFold is a tool used to generate production-ready server endpoints from API specifications. A security flaw in its webhook handling allows unauthorized individuals to send fake data to the server. This fake data is then stored and treated as legitimate information, which could lead to the corruption of data or the display of incorrect information to authorized users.
Technical details
APIFold's webhook receiver endpoint (`/webhooks/:serverSlug/:eventName`) fails to authenticate incoming requests or verify their signatures. The root cause is a coding error where `createWebhookRouter` is initialized without a `validators` map, causing an optional-chaining guard in `receivers.ts` to evaluate to `undefined` and bypass the signature-validation block entirely. An unauthenticated remote attacker who knows a valid server slug can inject arbitrary JSON payloads into the system's Redis and PostgreSQL databases. This injected data is subsequently served as trusted resource state to legitimate Model Context Protocol (MCP) clients. The issue is fixed in commit 7f19b52280f414f57af2b79a95333d1c8fbeece5 by enforcing fail-closed signature validation.
Affected products
- Work90210 APIFold <= 0.2.0
Timeline
- 2026-05-19: patched: Fix merged in commit 7f19b52280f414f57af2b79a95333d1c8fbeece5
- 2026-07-23: disclosed: Public advisory published via GitHub and NVD