AIKIDO-2026-10384

TL;DR

Affected versions of this package are affected by an authentication bypass vulnerability due to insufficient validation of HTTP signature components during request verification. The implementation does not strictly validate certain parsed fields, allowing malformed or ambiguous input to be interpreted in a way that bypasses signature verification. An attacker could exploit this by crafting requests where the verified signature does not accurately reflect the intended signed data, potentially allowing unauthorized or tampered requests to be accepted as valid. The issue is addressed by enforcing stricter validation and parsing of signature inputs during verification.