Threats tagged 'ghsa-fffc-w3w6-p7qp'

CoopCycle coopcycle-web versions 5.6.0 up to but not including 6.20.0 have a missing authentication vulnerability. This flaw allows unauthenticated attackers to forge Zelty webhook events because the HMAC signature (x-zelty-hmac-sha256) is never verified. Exploitation enables attackers to send forged POST requests to /api/zelty/webhook/* endpoints, potentially toggling restaurant products and altering order preparation states.