AIKIDO-2025-10982

TL;DR

Affected versions of this package are vulnerable to a Timing Attack on webhook signature verification due to the use of a non-constant-time string comparison function (like a simple === operator) when validating the Signature header against the HMAC hash, allowing an attacker to exploit minute timing differences in the comparison operation to iteratively guess the correct HMAC signature and forge malicious webhook requests.