A logic error in the verifyWebhook function causes the verification condition to invert, allowing a request lacking the X-Hub-Signature-256 header to pass without HMAC validation. When such an unauthenticated request is accepted, the function proceeds to postComment, using the repository and issue objects supplied in the request body and the configured GITHUB_TOKEN. This flaw lets an attacker direct the deployed bot to post arbitrary comments on any GitHub repository and issue for which the token is authorized, creating a vector for defacement, spam, or malicious information disclosure.

The vulnerability affects the appwrite:templates component of Appwrite, specifically the github-issue-bot template. No specific version information is disclosed in the advisory.

The CVSS score of 6.9 indicates moderate to high risk, and no EPSS score is available, so the likelihood of exploitation is unknown but the vulnerability is not listed in CISA KEV. An attacker can exploit the flaw remotely by sending a crafted HTTP request without the signature header to the webhook endpoint. The condition short‑circuits to success, enabling the function to post a comment as the bearer of the GITHUB_TOKEN, effectively granting write access to arbitrary repositories and issues.