CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



GHSA-9R75-G2CR-3H76

GHSA-9r75-g2cr-3h76: Predictable Webhook Tokens in Vercel Workflow

Amit Schendel
Amit Schendel
Senior Security Researcher

Mar 6, 2026·5 min read·36 visits

Executive Summary (TL;DR)

The Vercel Workflow SDK allowed developers to set predictable tokens for public webhooks. Attackers can guess these tokens to manipulate running workflows without authentication. Fixed in version 4.2.0 by enforcing random token generation.

A high-severity vulnerability exists in the Vercel Workflow DevKit (`@workflow/core`) affecting the `createWebhook()` function. The vulnerability allows developers to manually specify predictable tokens for public webhook endpoints, leading to an Insecure Direct Object Reference (IDOR) flaw. Unauthenticated attackers can guess these tokens (e.g., `github_webhook:repo_name`) and send malicious POST requests to resume paused workflows, inject data, or trigger unauthorized state transitions. The vendor has patched this by removing the ability to specify custom tokens in favor of mandatory cryptographically secure identifiers.

Vulnerability Overview

The Vercel Workflow DevKit provides a framework for building durable, long-running workflows in TypeScript. A core feature of this library is the ability to pause a workflow and wait for an external event via a webhook. This is implemented using the createWebhook() function, which generates a unique URL that external services (like Stripe or GitHub) can call to resume execution.

Prior to version 4.2.0, createWebhook() accepted an optional token parameter. This allowed developers to manually define the identifier used in the webhook URL (e.g., https://api.app/.well-known/workflow/v1/webhook/{token}). Because developers often prioritize readability or determinism, they frequently used predictable identifiers derived from public data, such as Repository IDs, Tenant IDs, or Slack Channel IDs.

This design flaw creates a significant attack surface. By predicting these tokens, an unauthenticated attacker can construct valid webhook URLs and trigger workflow resumption. This effectively bypasses the implicit authentication of the 'secret' URL, allowing unauthorized actors to inject payloads into the workflow context.

Root Cause Analysis

The root cause is a design vulnerability classified as CWE-639: Authorization Bypass Through User-Controlled Key (specifically, an Insecure Direct Object Reference). The SDK relied on the secrecy of the webhook URL as the sole mechanism for authentication but simultaneously allowed users to make that URL predictable.

The vulnerability manifests in the WebhookOptions interface. By exposing the token property to the developer, the library delegated security responsibility to the user without enforcing entropy requirements. Common integration patterns encouraged the use of semantic identifiers (e.g., github_webhook:${repo.id}) rather than random strings. Since the URL format is standardized (/.well-known/workflow/v1/webhook/...), the token was the only variable component protecting the workflow endpoint.

Furthermore, the system did not implement secondary authentication (such as signature verification) by default on these endpoints, meaning knowledge of the URL was sufficient to successfully execute the webhook logic.

Code Analysis & Patch

The vulnerability exists in the createWebhook function in @workflow/core. The patch resolves the issue by explicitly forbidding the token property in the options object and forcing the use of internal random generation.

Vulnerable Implementation (Conceptual):

// Pre-patch: Token is accepted and used directly
export function createWebhook(options) {
  // If user provides a token, use it; otherwise generate one
  const token = options.token || generateRandomId();
  return { 
    url: `https://.../webhook/${token}`,
    ...
  };
}

Patched Implementation: In the fixed version, the library actively validates the input options to ensure no token is provided. If a developer attempts to pass a token, the SDK throws a runtime error, preventing the application from starting or the webhook from being created with a weak identifier.

// packages/core/src/workflow/create-hook.ts
export function createWebhook(
  options?: WebhookOptions
): Webhook<Request> | Webhook<RequestWithResponse> {
  // Destructure token to check for its existence
  const { respondWith, token, ...rest } = (options ?? {}) as WebhookOptions & {
    token?: string;
  };
 
  // CRITICAL FIX: Explicitly reject user-defined tokens
  if (token !== undefined) {
    throw new Error(
      '`createWebhook()` does not accept a `token` option. Webhook tokens are always randomly generated. Use `createHook()` with `resumeHook()` for deterministic token patterns.'
    );
  }
  
  // ... subsequent logic uses internal secure ID generation
}

This change enforces a secure-by-default posture. By removing the token option from the public API surface, the library guarantees that all generated webhooks utilize high-entropy identifiers that are infeasible to guess.

Exploitation Scenario

An attacker can exploit this vulnerability by conducting reconnaissance on Vercel-hosted applications to identify workflow endpoints and then guessing the tokens based on the application's context.

1. Reconnaissance: The attacker scans for the standard Vercel Workflow path: /.well-known/workflow/v1/webhook/. A 404 or 405 response indicates the path exists but the specific token is missing, confirming the usage of the SDK.

2. Token Prediction: If the target application integrates with GitHub, an attacker might hypothesize the token format github_webhook:{repo_name}. For a repository named company/hiring-bot, the predicted token would be github_webhook:company:hiring-bot (or similar URL-safe variations).

3. Payload Injection: The attacker sends a POST request to the constructed URL:

curl -X POST https://target-app.vercel.app/.well-known/workflow/v1/webhook/github_webhook:company:hiring-bot \
  -H "Content-Type: application/json" \
  -d '{"action": "approve_candidate", "candidate_id": "attacker-id", "bypass_checks": true}'

4. Execution: If a workflow instance is currently awaiting this webhook, it consumes the JSON payload. The workflow proceeds using the attacker's data, effectively allowing unauthenticated remote execution of subsequent workflow steps.

Impact Assessment

The impact of this vulnerability is high, specifically affecting the Integrity of the application logic. While it does not directly expose the underlying server file system (Confidentiality), it allows for significant manipulation of business logic.

  • Unauthorized State Transitions: Attackers can force workflows to advance prematurely or skip validation steps by supplying fabricated success signals.
  • Data Injection: Malicious payloads injected via the webhook are treated as trusted input by the workflow. This can lead to database corruption, unauthorized API calls to third-party services (e.g., sending emails, processing payments), or logic flaws.
  • Resource Exhaustion: An attacker could trigger a large number of 'zombie' workflow resumptions, potentially incurring costs on the serverless platform or hitting API rate limits.

CVSS v3.1 Estimate: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L (Score: 8.2 - High). The attack vector is Network, requires no privileges, and has High Integrity impact.

Official Patches

GitHubCommit fixing the vulnerability by removing token option

Fix Analysis (1)

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Affected Systems

Vercel Workflow DevKit@workflow/core npm package

Affected Versions Detail

Product
Affected Versions
Fixed Version
@workflow/core
Vercel
< 4.2.0-beta.644.2.0-beta.64
AttributeDetail
Attack VectorNetwork (Public Internet)
CVSS7.5 (High)
CWECWE-639 (IDOR)
ImpactWorkflow Manipulation / Data Injection
Affected ComponentcreateWebhook() API
RemediationUpgrade to @workflow/core@4.2.0+

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1566Phishing (Webhook Manipulation)
Initial Access
CWE-639
Insecure Direct Object Reference (IDOR)

Authorization Bypass Through User-Controlled Key

Vulnerability Timeline

Vulnerability Patched in vercel/workflow
2026-03-05
Release of @workflow/core@4.2.0-beta.64
2026-03-05
Public Advisory GHSA-9R75-G2CR-3H76 Published
2026-03-05

References & Sources

  • [1]GHSA-9R75-G2CR-3H76 Advisory
  • [2]Vercel Workflow API Documentation

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 6 hours ago•GHSA-7PPR-R889-MCF2
7.5

GHSA-7PPR-R889-MCF2: Unbounded WebSocket Message Aggregation in http4s-blaze-server leads to Denial of Service

An uncontrolled resource consumption vulnerability exists in the Scala-based http4s-blaze-server package of the http4s/blaze library. The vulnerability allows remote, unauthenticated attackers to cause an Out of Memory Error (OOM) and JVM crash by streaming a continuous sequence of small or empty WebSocket continuation frames with the FIN bit set to 0. This bypasses typical payload size checks because of the JVM's per-object allocation overhead, leading to rapid heap exhaustion with minimal network bandwidth.

Alon Barad
Alon Barad
6 views•5 min read
•about 7 hours ago•GHSA-95CV-R8X4-VH75
7.6

GHSA-95cv-r8x4-vh75: Path Traversal Vulnerability in OpenList Batch Rename Handler

A critical path traversal vulnerability has been identified in the OpenList Go-based backend package. The vulnerability exists within the batch rename handler because the application does not validate the source filename parameter before constructing filesystems paths. This omission allows authenticated users to escape their designated directory and rename files in sibling paths.

Amit Schendel
Amit Schendel
7 views•7 min read
•about 8 hours ago•GHSA-P6PH-3JX2-3337
4.3

GHSA-P6PH-3JX2-3337: Horizontal Privilege Escalation and Metadata Information Disclosure via Bleve Search in OpenList

OpenList version 4.2.3 and prior is vulnerable to an authorization bypass and metadata leakage. When configured with the Bleve search engine backend, OpenList fails to perform separator-aware path matching when validating tenant containment. This allows authenticated users to access sibling directories sharing similar name prefixes. Furthermore, the search backend returns unfiltered global result counts, leaking existence verification data of unauthorized files via side-channel analysis.

Amit Schendel
Amit Schendel
7 views•5 min read
•about 9 hours ago•GHSA-86CX-WWF4-PHQ4
6.5

GHSA-86cx-wwf4-phq4: Path Prefix Confusion Authorization Bypass in OpenList

An authorization bypass vulnerability in OpenList version 4.2.3 and below allows authenticated users to read arbitrary files outside of their designated base directories due to an insecure path prefix check using Go's standard strings.HasPrefix function.

Amit Schendel
Amit Schendel
6 views•6 min read
•about 10 hours ago•CVE-2026-16584
7.0

CVE-2026-16584: Security Policy Bypass in AWS API MCP Server via Startup Initialization Failure

A security policy bypass vulnerability exists in the AWS API MCP Server (awslabs-aws-api-mcp-server) from version 0.2.13 through 1.3.46. When the server fails to load the read-only operations index during startup (due to transient network failures, file permission issues, or other exceptions), it logs a warning but continues running in an insecure, degraded state. Under this condition, the security policy engine fails open, silently skipping all subsequent security checks and consent prompts for the lifetime of the process. This permits unauthorized mutating AWS CLI commands to execute via indirect prompt injection attacks.

Amit Schendel
Amit Schendel
6 views•7 min read
•about 11 hours ago•GHSA-6V4M-FW66-8R4X
6.5

GHSA-6V4M-FW66-8R4X: Path Disclosure and Shell Expansion Bypass in Shescape

An incomplete escaping vulnerability in the npm package 'shescape' allows unauthenticated users to trigger dynamic shell expansions, absolute path disclosure, and command block break-outs on Unix and Windows systems.

Alon Barad
Alon Barad
6 views•7 min read