{"action":"Upgrade axonflow to 6.7.0 or later.","affected":[{"fixed":"6.7.0","introduced":"0"}],"component":"axonflow","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["6.7.0"],"ghsa_id":"GHSA-7f4h-6264-89fr","id":"tcs_01M5KF5SNSG8K2T02RSXQGWN9B","modified_at":"2026-05-06T23:37:11.688752Z","published_at":"2026-05-06T23:14:43Z","references":["https://osv.dev/vulnerability/GHSA-7f4h-6264-89fr","https://github.com/getaxonflow/axonflow-sdk-python/security/advisories/GHSA-7f4h-6264-89fr","https://github.com/getaxonflow/axonflow-sdk-python"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-7f4h-6264-89fr","url":"https://osv.dev/vulnerability/GHSA-7f4h-6264-89fr"}],"summary":"axonflow-sdk-python: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification"}