[A-04] Tabletop Time webhook is unauthenticated #40

New issue

Open

opened 2026-10-11 20:15:34 -05:00 by pyaniz · 0 comments

pyaniz commented

2026-10-11 20:15:34 -05:00

Owner

Audit ID: A-04 · Priority: P1 · Effort: S

Tabletop Time webhook is unauthenticated (integrations/router.py). Anyone who knows or guesses a session UUID can cancel or reschedule a session and add attendees. There is no shared secret or signature check. Replayed FINALIZED events insert duplicate attendees. It also prints the full payload and returns str(e) to the caller.

Source: AUDIT_FINDINGS.md (audit 2026-10-11). Items marked (verify) need confirming first.

**Audit ID:** A-04 · **Priority:** P1 · **Effort:** S **Tabletop Time webhook is unauthenticated** (`integrations/router.py`). Anyone who knows or guesses a session UUID can cancel or reschedule a session and add attendees. There is no shared secret or signature check. Replayed `FINALIZED` events insert duplicate attendees. It also prints the full payload and returns `str(e)` to the caller. Source: `AUDIT_FINDINGS.md` (audit 2026-10-11). Items marked *(verify)* need confirming first.

pyaniz added the

audit

security

labels

2026-10-11 20:15:34 -05:00