{"id":"EUVD-2026-78685","revision":"ce51f851bbd44fcb9ce3fea2a5280f8e","records":[{"revision":"ce51f851bbd44fcb9ce3fea2a5280f8e","observedAt":"2026-11-03T12:00:32.073+00:00","statement":{"source":"euvd","id":"EUVD-2026-78685","aliases":["CVE-2026-59157","GHSA-v25g-mvwr-f5fp"],"title":"webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsTo…","description":"webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script environment without an allowlist. When an upstream reverse proxy did not strip a client-supplied X-WebAuthn-User header and a hook script trusted that variable for identity or privilege, a remote unauthenticated attacker could spoof another user, bypass script security controls, and access or modify resources available to the impersonated identity. This issue is fixed in version 1.22.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":null}],"references":["https://github.com/ncarlier/webhookd/security/advisories/GHSA-v25g-mvwr-f5fp","https://github.com/ncarlier/webhookd/pull/121","https://github.com/ncarlier/webhookd/commit/5ac66677bf7224191f1dfc51a875b09187d10beb","https://github.com/ncarlier/webhookd/releases/tag/v1.22.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78685","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 15, 2026, 3:46:35 PM","dateUpdated":"Sep 16, 2026, 3:38:42 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-78685","identifiers":["EUVD-2026-78685","CVE-2026-59157","GHSA-v25g-mvwr-f5fp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}