SNS webhook signature bypass in Plunk email platform (CVE-2026-42193)

The `/webhooks/sns` endpoint in Plunk accepts Amazon SNS notification payloads without verifying the SNS signature, certificate, or topic ARN, allowing any unauthenticated remote attacker to forge webhook requests. A successful exploit enables spoofing of SNS events to trigger workflow automations, unsubscribe contacts, manipulate email delivery metrics, and potentially exhaust billing credits. Affected versions: - < 0.8.0 We recommend updating to: 0.9.0. CVSS 9.1 · our assessment: act_now Reference: https://github.com/useplunk/plunk/security/advisories/GHSA-9792-w86v-gx53 Details: https://vuln.today/cve/CVE-2026-42193