GHSA-248h-974q-xrc2: axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification
(updated )
The AxonFlow SDK’s WebhookSubscription (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform’s CreateWebhook endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the X-AxonFlow-Signature header on incoming webhook deliveries. Affected callers had two unsatisfactory options:
- Skip signature verification entirely — accepting any payload from any source that knew the webhook URL.
- Hand-parse the raw HTTP JSON response to extract the secret, bypassing the type-safe SDK surface.
This advisory is filed across all four AxonFlow SDKs (Go, Python, TypeScript, Java) because the same defect and the same fix landed in each.
References
- github.com/advisories/GHSA-248h-974q-xrc2
- github.com/getaxonflow/axonflow-sdk-java/blob/bac65ce6143327e1f9201d0dc73815e93dcdb47c/CHANGELOG.md?plain=1
- github.com/getaxonflow/axonflow-sdk-java/commit/53c049a2ff34e7d9ef428bf6f24dac050200f5bc
- github.com/getaxonflow/axonflow-sdk-java/pull/156
- github.com/getaxonflow/axonflow-sdk-java/security/advisories/GHSA-248h-974q-xrc2
Code Behaviors & Features
Detect and mitigate GHSA-248h-974q-xrc2 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →