Webhook without visible signature verification
HighAV-NET-003NetworkCore pack
What it finds
A `/webhook`/`/callback`/`webhookUrl` pattern without `verifySignature`/`x-hub-signature`/`stripe-signature`/`hmac` nearby.
Why it matters
An unverified webhook accepts instructions from anyone who can reach the URL, not just the intended sender.
How to fix it
Verify an HMAC/signature header on every inbound webhook before processing it.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- WEBHOOK_WITHOUT_VERIFICATION
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Server source exposing webhook/callback endpoints
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Server-side request to a caller-controlled URLAV-NET-004 · High
- TLS certificate verification disabledAV-NET-005 · High
- Code reaches the cloud metadata endpointAV-NET-006 · High
- Plaintext HTTP endpointAV-NET-001 · Medium
- Permissive CORS (wildcard origin)AV-NET-002 · Medium
- Remote MCP server over unencrypted HTTPAV-MCP-110 · Medium