Evidence · DiggingBeagle record
GitHub Advisory GHSA-h8j8-r6g6-37hc: cc-connect webhook authentication
October 10 advisory describes unauthenticated MAX webhook updates when webhook_secret is missing and possible impersonation of a privileged account; affected and patched version fields remain unknown.
- Published
- Oct 10, 2026
- Publisher
- GitHub Advisory Database / NVD
- Source role
- secondary reporting
Evidence record
October 10 advisory describes unauthenticated MAX webhook updates when webhook_secret is missing and possible impersonation of a privileged account; affected and patched version fields remain unknown.
Claim-level citations (3)
- supportsAn unsigned cc-connect MAX webhook could impersonate a privileged chat operator: The published GHSA states that cc-connect MAX webhook mode accepts unauthenticated updates when webhook_secret is not configured.
Description, platform/max/max.go and no webhook_secret condition
- supportsAn unsigned cc-connect MAX webhook could impersonate a privileged chat operator: The October 10 GitHub Advisory lists unknown affected and patched version tables, although its prose names versions through 1.5.0.
Affected versions; Patched versions; Description
- supportsAn unsigned cc-connect MAX webhook could impersonate a privileged chat operator: The same GHSA reports that a network-reachable sender can forge an allowed or administrator user_id to invoke privileged commands such as /shell on the host.
Description, forged allowed or admin user_id