AIKIDO-2026-202363

TL;DR

The RequestVerification middleware in slack_bolt skips Slack request signature verification whenever the form body contains ssl_check=1. When an application disables the built-in SSL check middleware, this exemption lets an unsigned HTTP request continue through the normal middleware and listener pipeline, so a forged request that omits a valid x-slack-signature can reach slash command and event handlers. This lets untrusted input invoke handler logic without a valid Slack signature. The fix removes the ssl_check exemption so signature verification is required for all HTTP requests and only Socket Mode requests are skipped.