Templates
Monthly
Webhook signature bypass in the appwrite/templates github-issue-bot (≤ 1.1.2) allows any unauthenticated network caller to invoke the bot's comment-posting functionality without a valid GitHub HMAC signature. An inverted boolean condition in verifyWebhook causes requests lacking the X-Hub-Signature-256 header to short-circuit to success, so the body is processed as if it were a legitimate GitHub event. With attacker-controlled repository, issue, and author fields passed directly to postComment, the deployment's GITHUB_TOKEN is used to post arbitrary comments on any accessible GitHub repository and issue. No public exploit code is identified at time of analysis.
Webhook signature bypass in the appwrite/templates github-issue-bot (≤ 1.1.2) allows any unauthenticated network caller to invoke the bot's comment-posting functionality without a valid GitHub HMAC signature. An inverted boolean condition in verifyWebhook causes requests lacking the X-Hub-Signature-256 header to short-circuit to success, so the body is processed as if it were a legitimate GitHub event. With attacker-controlled repository, issue, and author fields passed directly to postComment, the deployment's GITHUB_TOKEN is used to post arbitrary comments on any accessible GitHub repository and issue. No public exploit code is identified at time of analysis.