CVE-2026-54635: pytonapi Authentication Bypass Vulnerability

CVE-2026-54635 Overview

CVE-2026-54635 is an authentication bypass vulnerability in pytonapi, a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. The flaw affects versions 2.0.0 through 2.2.0 of the TonapiWebhookDispatcher component. When a webhook handler registers with the documented custom path argument, setup() stores bearer tokens only under the default suffix paths. The custom path is never added to the token map, causing self._tokens.get(path) to return None and the authentication guard to be skipped. Unauthenticated remote attackers can POST forged payloads to the custom webhook endpoint and trigger victim-defined handlers. The issue is fixed in version 2.2.1.

Critical Impact
Unauthenticated remote attackers can bypass bearer token authentication and invoke arbitrary webhook handlers, compromising integrity of downstream application logic.

Affected Products

pytonapi version 2.0.0
pytonapi versions 2.0.x through 2.2.0
Applications using TonapiWebhookDispatcher with custom path arguments

Discovery Timeline

2026-07-28 - CVE-2026-54635 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-54635

Vulnerability Analysis

The vulnerability is an improper authentication flaw [CWE-287] in the TonapiWebhookDispatcher class. The dispatcher registers bearer tokens during setup() to authenticate incoming webhook POST requests. When developers use the default webhook path, tokens map correctly to the endpoint. However, when developers pass a custom path argument (as documented in the library), setup() fails to register that path in the internal token map.

The authentication guard checks self._tokens.get(path) before validating the Authorization header. When this lookup returns None, the guard treats the request as not requiring authentication and skips header validation entirely. Attackers exploit this by sending crafted POST requests to any custom webhook endpoint without valid bearer credentials.

Root Cause

The root cause is a path registration mismatch between token storage and request routing. The setup() method binds bearer tokens only to hard-coded default suffix paths. The custom path parameter reaches the HTTP route registration but bypasses the token map population step. This creates an inconsistent state where the route accepts requests but no authentication material exists to enforce.

Attack Vector

Remote attackers exploit this over the network without authentication or user interaction. The attacker identifies the custom webhook endpoint URL, then sends a POST request containing a forged TON blockchain event payload. The dispatcher accepts the request, skips authentication because no token is registered for the path, and dispatches the payload to victim-defined handlers. Handler logic may process financial transactions, update databases, or trigger downstream actions based on the forged event.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-3fcr-jvgp-7f58 for technical details.

Detection Methods for CVE-2026-54635

Indicators of Compromise

Unexpected POST requests to custom webhook endpoints lacking a valid Authorization: Bearer header
Webhook handler executions with no corresponding authenticated request in access logs
Anomalous downstream state changes tied to TON blockchain events not observed on-chain
Requests to webhook paths from source IPs outside the documented TONAPI infrastructure ranges

Detection Strategies

Inventory Python dependencies and identify applications importing pytonapi versions 2.0.0 through 2.2.0
Enable HTTP request logging on webhook endpoints and alert on missing or malformed Authorization headers
Compare inbound webhook events against expected on-chain activity to identify forged payloads
Review application logs for handler executions that lack a preceding token validation entry

Monitoring Recommendations

Log full request headers and source IPs for all POST traffic to custom webhook paths
Alert on webhook POSTs originating from IPs not in the TONAPI service allowlist
Track baseline webhook event volume and flag statistical anomalies
Forward webhook access logs to a centralized SIEM for correlation with application behavior

How to Mitigate CVE-2026-54635

Immediate Actions Required

Upgrade pytonapi to version 2.2.1 or later across all affected deployments
Audit webhook handlers for state changes made since 2.0.0 was deployed and reconcile against on-chain data
Rotate any bearer tokens issued to the affected webhook endpoints
Restrict inbound network access to webhook endpoints using an IP allowlist for TONAPI infrastructure

Patch Information

The maintainer released the fix in pytonapi v2.2.1. The corrective change is documented in the upstream commit 854222b. The patch registers the custom path in the internal token map during setup() so the authentication guard executes for all configured routes.

Workarounds

Avoid passing a custom path argument to TonapiWebhookDispatcher and use the default suffix paths until upgrading
Place a reverse proxy in front of the webhook endpoint that enforces Authorization: Bearer header validation independently
Restrict webhook endpoint access at the network layer to known TONAPI source IP ranges
Add application-level middleware that validates bearer tokens before requests reach the dispatcher

bash

# Upgrade pytonapi to the patched version
pip install --upgrade 'pytonapi>=2.2.1'

# Verify installed version
pip show pytonapi | grep -i version