TI-2026-84351 CVE-2026-121545 · GHSA-vwg6-vcv8-xg59
Dreeve accepts forged Strava webhook events, deleting activities
Priority HIGH 70
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owne…