Threats tagged 'ghsa-vwg6-vcv8-xg59'

Dreeve versions before 5.8.0 have a missing authentication vulnerability in the StravaWebhookRequestHandler::handleEvent function. This flaw allows unauthenticated attackers to forge Strava webhook events without proper signature, verify-token, or owner_id validation. Exploitation can lead to attackers sending forged delete events with known public Strava activity IDs to the webhook URL, resulting in permanent deletion of imported activities and their associated data streams.