GHSA-248h-974q-xrc2: axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
(updated )
The AxonFlow SDK’s WebhookSubscription (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform’s CreateWebhook endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the X-AxonFlow-Signature header on incoming webhook deliveries. Affected callers had two unsatisfactory options:
- Skip signature verification entirely — accepting any payload from any source that knew the webhook URL.
- Hand-parse the raw HTTP JSON response to extract the secret, bypassing the type-safe SDK surface.
This advisory is filed across all four AxonFlow SDKs (Go, Python, TypeScript, Java) because the same defect and the same fix landed in each.
References
- github.com/advisories/GHSA-248h-974q-xrc2
- github.com/getaxonflow/axonflow-sdk-java/blob/bac65ce6143327e1f9201d0dc73815e93dcdb47c/CHANGELOG.md?plain=1
- github.com/getaxonflow/axonflow-sdk-java/commit/53c049a2ff34e7d9ef428bf6f24dac050200f5bc
- github.com/getaxonflow/axonflow-sdk-java/pull/156
- github.com/getaxonflow/axonflow-sdk-java/security/advisories/GHSA-248h-974q-xrc2
Code Behaviors & Features
Detect and mitigate GHSA-248h-974q-xrc2 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →