{"action":"Upgrade @axonflow/sdk to 6.0.0 or later.","affected":[{"fixed":"6.0.0","introduced":"0"}],"component":"@axonflow/sdk","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["6.0.0"],"ghsa_id":"GHSA-mph8-9v29-pm42","id":"tcs_01M5KG1A9EJTK7BTNQXYS7APKM","modified_at":"2026-05-06T23:35:57.327389Z","published_at":"2026-05-06T23:16:24Z","references":["https://osv.dev/vulnerability/GHSA-mph8-9v29-pm42","https://github.com/getaxonflow/axonflow-sdk-typescript/security/advisories/GHSA-mph8-9v29-pm42","https://github.com/getaxonflow/axonflow-sdk-typescript"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-mph8-9v29-pm42","url":"https://osv.dev/vulnerability/GHSA-mph8-9v29-pm42"}],"summary":"axonflow-sdk-typescript: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification"}