Executive brief
pytonapi is a Python library used by developers to interact with the TON blockchain, specifically for handling real-time updates via webhooks. A security flaw in the way it handles custom webhooks allows unauthorized individuals to bypass security checks. This means an attacker could send fake blockchain transaction data to an application, potentially tricking it into processing fraudulent payments or updating account states incorrectly.
Technical details
An authentication bypass exists in the TonapiWebhookDispatcher component of pytonapi versions 2.0.0 through 2.2.0. The vulnerability occurs because the `setup()` method only registers security tokens for default suffix paths and fails to map them to custom paths provided via the `path` argument. Consequently, when a request is received on a custom path, the `expected_token` lookup returns `None`, causing the authentication guard to be skipped entirely (fail-open). An unauthenticated remote attacker can exploit this by sending POST requests with forged JSON payloads to custom webhook endpoints, successfully triggering victim-defined handlers. This issue is resolved in version 2.2.1 by ensuring tokens are correctly mapped to all registered paths.
Affected products
- nessshon pytonapi >= 2.0.0, < 2.2.1
Timeline
- 2026-06-08: patched: Fix committed and version 2.2.1 released
- 2026-07-28: disclosed: Public advisory published