CVE-2026-72922: AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.70, AutoGPT's autogptplatform/backend/backend/api/features/integrations/router.py webhookingressgeneric route selected getwebhookmanager(provider) from the untrusted provider URL segment without verifying webhook.provider, allowing a request to /compass/webhooks/{webhookid}/ingress to use CompassWebhookManager's inherited no-op BaseWebhooksManager.verifysignature instead of GenericWebhooksManager.verifysignature, bypass X-Webhook-Secret for a configured secrettoken, and execute a generic webhook graph as its owner. This issue is fixed in version 0.6.70.