com.getaxonflow vulnerabilities

Products

• com.getaxonflow/axonflow-sdk 1

Latest com.getaxonflow CVEs

Newest publication first

1. GHSA-248h-974q-xrc2 axonflow-sdk-java: Webhook signing-key (HMAC-SHA256) not exposed by SDK type, preventing signature verification

   Published 2026-05-06

   Medium·CVSS 5.9

   Summary The AxonFlow SDK's WebhookSubscription (or equivalent) type did not expose the HMAC-SHA256 signing key returned by the platform's CreateWebhook endpoint. Without access to the secret through the typed SDK API, callers had no path to verify the X-AxonFlow-Signature header...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.