AIKIDO-2026-11052
windmill-cli is vulnerable to Improper Authentication
72
High Risk
This Affects:
windmill-cliTL;DR
The Zoom challenge handler previously accepted attacker-controlled plainToken values and could be abused as a signing oracle, enabling attackers to obtain valid signatures for forged request bodies. The fix adds strict validation of plainToken format (rejecting colon-containing or overly long tokens), blocking the crafted token format required for the abuse.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and if you use Zoom challenge/webhook signing.
Background info
windmill-cli is vulnerable to Improper Authentication in versions 1.479.0 - 1.714.0.
How to fix this
Upgrade the windmill-cli library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant