AIKIDO-2025-10700

TL;DR

Affected versions of this package are vulnerable to a Timing Attack in the webhook signature verification function due to a non-constant-time string comparison. The vulnerable code used a standard equality operator to compare the expected and provided HMAC digests, which allows an attacker to exploit microscopic timing differences in the comparison operation. By repeatedly submitting forged signatures and measuring the server's response time, an attacker could gradually deduce the correct HMAC value character by character.