AIKIDO-2026-10991

TL;DR

The WorkOS Node SDK verifies webhook and action request signatures by HMAC over a derived payload string. Before the fix, raw request bytes were re-encoded with JSON.stringify, so verification did not use the exact wire bytes WorkOS signed and could accept JSON-normalized variants that differ on the wire but parse to the same object. An attacker who can POST to a webhook or action endpoint may replay or mutate signed payloads in ways that weaken byte-level integrity checks. The fix HMACs decoded raw bytes directly and parses JSON only after verification succeeds.