Webhook signature is optional
A webhook is an authenticated call from another system. The gadget is a verifier that runs only when the signature header is present, accepts an empty secret, or fails open when verification throws. A signature that can be turned off is a misconfig, and an…
Tags: webhook, misconfig, integrity, fail-open
Typical severity: P2-P4
What it becomes
Low alone when the URL is unguessable and unsigned calls are rejected, and it becomes a forged event when the handler trusts the body without a required signature.
Where to look
billing and provisioning callbackssource-control and chat event receiverssandbox or test-mode verifiers left on
Chains
- Forged state change: The handler applies a role, billing, or provision change when the signature header is absent or the secret is empty.
- Fail open: A verifier error, a clock check, or a test-mode flag skips verification and the event is still applied.
Notes
- Send events to an endpoint you own, or use the provider test event on your tenant. Do not post events into another customer's callback.
- A URL fetch performed by a webhook tester is a different bug. This gadget is whether the receiver requires a signature.