Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck

CVE-2026-85667xiaobei through 5.5.2 Unauthenticated Webhook Message Injection

Critical 9.1

In plain English

A critical-severity missing authentication in xiaobei from TeamWiseFlow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.7%top 46.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhook_worktool handler and exploit unvalidated media URL fetching to perform server-side request forgery against internal services.

Affected products (as reported)

Vendor	Product	Versions
TeamWiseFlow	xiaobei	0 – through 5.5.2

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Issue #440 issue-tracking
https://github.com/TeamWiseFlow/xiaobei product
https://github.com/TeamWiseFlow/xiaobei/blob/v5.5.2/awada/awada-server/src/routes/webhook-worktool.ts technical-description
VulnCheck Advisory: xiaobei through 5.5.2 Unauthenticated Webhook Message Injection third-party-advisory