Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens

Description

createWebhook() in Vercel Workflow DevKit accepts a user-specified token parameter that serves as the credential for the public webhook endpoint /.well-known/workflow/v1/webhook/{token}.

Recommendation

Update the @workflow/core package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.1.0-beta.63
• Patched version(s): 4.2.0-beta.64

References

• GHSA-9r75-g2cr-3h76
• CWE-287
• OWASP 2021-A7

Related Issues

• Vercel Workflow Allows Webhook Creation with Predictable User-Specified Tokens - workflow - Vulnerability
• @saltcorn/data: Tenant user role is used for tenant creation role check - Vulnerability
• Nuxt OG Image vulnerable to Server-Side Request Forgery via user-controlled parameters - Vulnerability
• SillyTavern: Path Traversal in `/api/chats/export` and `/api/chats/delete` allows arbitrary file read/delete within user - CVE-2026-34524

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@workflow/core