EUVD-2026-71123
GHSA-g573-j843-xr77
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network webhook with no signature check gives AV:N/AC:L/PR:N/UI:N; message injection is I:H and SSRF reaching internal services supports C:H, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.
AnalysisAI
Unauthenticated message injection and server-side request forgery in TeamWiseFlow xiaobei through 5.5.2 let remote attackers reach the agent pipeline without any credentials. The webhook endpoints implement neither authentication nor signature validation (CWE-306), so an attacker can POST crafted payloads to the /webhook_worktool handler to inject arbitrary messages, and abuse the handler's unvalidated media-URL fetching to make the server issue requests to internal services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs only network reachability to the xiaobei server's /webhook_worktool endpoint; no authentication, credentials, signature, or user interaction is required because the webhook implements no auth or signature validation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, score 9.3) describes a network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact and no availability impact - internally consistent with an unauthenticated webhook that both injects messages (integrity) and performs SSRF that can read internal resources (confidentiality). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data (the advisory and issue #440 describe the flaw in 5.5.2 without citing a fixed release), so treat this as No vendor-released patch identified at time of analysis and monitor the GitHub repository and VulnCheck advisory for an update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all TeamWiseFlow xiaobei installations running version 5.5.2 or earlier and restrict network access to the /webhook_worktool endpoint to explicitly trusted sources only using firewall rules or reverse-proxy IP whitelisting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today