Verified Backfilled · Original publication July 21, 2026Standards & ProtocolsCrawlers & Content ControlsAgentic Web Web Bot Auth (spec repo) ·

Web Bot Auth Fixes Signature Verification Bypass Allowing Request Replay

Open source ↗

Summary

A vulnerability in the Web Bot Auth implementation allowed signatures with empty component lists to pass verification without binding to a request target. Pull request #114 resolves security advisory GHSA-x9cc-346q-g27m by requiring signature coverage of @authority or @target-uri and signature-agent headers. The fix ensures verification binds signatures to specific HTTP request targets, matching the behavior of the Rust reference implementation.

Insight

Cryptographic signature validation provides no protection against replay or request substitution if the verifier does not strictly enforce component binding to the target URI and authority.

Implication

Implementers and adopters using the Web Bot Auth verification libraries must ensure their verification logic validates required covered components to prevent credential replay across different endpoints.

Why it matters

Emerging bot authentication standards depend entirely on request-bound cryptographic proof, making component verification enforcement essential to preventing unauthorized automated traffic spoofing.

Evidence