{"action":"Upgrade github.com/getaxonflow/axonflow-sdk-go/v5 to 5.7.0 or later.","affected":[{"fixed":"5.7.0","introduced":"0"}],"component":"github.com/getaxonflow/axonflow-sdk-go/v5","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["5.7.0"],"ghsa_id":"GHSA-mhc4-qq83-fmrr","id":"tcs_01M5KFFY83XCAN5HB2Y3797KSJ","modified_at":"2026-06-25T23:11:49.510736169Z","published_at":"2026-05-06T23:15:38Z","references":["https://osv.dev/vulnerability/GHSA-mhc4-qq83-fmrr","https://github.com/getaxonflow/axonflow-sdk-go/security/advisories/GHSA-mhc4-qq83-fmrr","https://github.com/getaxonflow/axonflow-sdk-go"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-mhc4-qq83-fmrr","url":"https://osv.dev/vulnerability/GHSA-mhc4-qq83-fmrr"}],"summary":"axonflow-sdk-go: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification"}