AIKIDO-2026-300100
@chat-adapter/x is vulnerable to Authentication Bypass
75
High Risk
This Affects:
@chat-adapter/xTL;DR
The X adapter answers the platform CRC challenge by returning an HMAC signature computed over the supplied challenge token using the app's webhook secret. Because the public challenge endpoint signs arbitrary input, it acts as a signing oracle that can produce valid signatures for webhook-shaped payloads. Externally supplied requests can then present those signatures to forge inbound X events that pass webhook verification. The fix validates CRC challenge input and rejects webhook-shaped tokens before signing.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the X adapter's public webhook CRC challenge endpoint.
Background info
@chat-adapter/x is vulnerable to Authentication Bypass in versions 4.33.0 - 4.36.0.
How to fix this
Upgrade the @chat-adapter/x library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant