The vulnerability resides in the pytonapi SDK versions 2.0.0 through 2.2.0 where the TonapiWebhookDispatcher does not validate the Authorization header for webhook endpoints registered with a custom path. When a custom path is used, the internal token map contains no entry for that path, causing the authentication guard to be skipped. This allows any unauthenticated client to POST forged payloads to the custom webhook endpoint and trigger handlers that have been predefined by the victim. As the handlers run with the application’s privileges, an attacker can influence the execution of arbitrary code or modify application state, resulting in a high integrity impact. The weakness is a failed authentication guard – CWE‑287.

Vendor nessshon, product tonapi (Python SDK for TON blockchain). Versions affected are 2.0.0 through 2.2.0 inclusive; the issue is fixed in version 2.2.1 and later.

The base CVSS score of 7.5 reflects a moderate to high severity, primarily due to the integrity impact. The EPSS score of less than 1% indicates a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending unauthenticated HTTP POST requests to a custom webhook URL, exploiting the missing authorization check. No special privileges or local access are required, making it a straightforward remote attack vector.