[Security] [MEDIUM] Broken PSR-4 autoloader makes WebhookVerify class undiscoverable

[cursor]

Summary

Severity: MEDIUM
Source: Cursor vulnerability scan (2026-07-13)
Repository: lomi-php-sdk
Location: composer.json
Verified: code-traced
Scan run: bc-f24f5646-ca8a-445d-a92a-efe4da6536a4
Commit: bd55ea131730a2deb955b74dcac715b0dfff9d0f

Description

The composer.json autoloader maps LomiSDK\ to lib/, but all SDK classes use the Lomi\ namespace under src/. The WebhookVerify class (implementing HMAC-SHA256 signature verification with timing-safe comparison) is not imported by any other SDK class, is not documented in the README (which still documents the obsolete OpenAPI Generator LomiSDK\ API), and has zero test coverage. Even after a merchant manually fixes autoloading for LomiClient, WebhookVerify remains undiscoverable through standard integration channels.

Impact

Merchants integrating this payment SDK have no realistic path to discover the existing webhook signature verification capability. Without verification, merchants' webhook endpoints accept forged payment events (e.g., payment.completed, refund.created), enabling attackers to trigger order fulfillment or access grants without actual payment — direct payment fraud.

Attack path

1. Merchant installs lomiafrica/lomi-php-sdk via Composer and manually fixes the broken autoloader to make LomiClient functional
2. WebhookVerify is never discovered because it is not referenced by any other class, not documented in the README, not tested, and the method manifest (sdk_php_methods.json) lists verifySignature under WebhooksService which does not implement it
3. Merchant implements a webhook handler without signature verification since no verification mechanism is discoverable through standard channels
4. Attacker discovers the merchant's webhook URL and sends forged payment event payloads matching lomi's webhook format
5. Merchant's application processes fraudulent events as legitimate, fulfilling orders or granting access without payment

Evidence

• composer.json:33-34 — PSR-4 mapping declares LomiSDK\ → lib/, but actual code uses Lomi\ namespace in src/
• src/WebhookVerify.php:8 — class exists with correct HMAC-SHA256 + hash_equals implementation but is never imported by any other file in the repository
• README.md:46-73 — Getting Started documents obsolete LomiSDK\Configuration API with zero mention of WebhookVerify or webhook signature verification
• src/sdk_php_methods.json:167 — method manifest lists verifySignature under webhooks service, but WebhooksService.php does not implement it, creating a false expectation

Remediation

Fix composer.json autoload to map "Lomi\\" → "src/". Document WebhookVerify::verify() usage in the README with concrete examples. Alternatively, add a verifySignature() method to WebhooksService that delegates to WebhookVerify::verify(), matching the method manifest and making verification discoverable through the primary client object.

PoC

Video not feasible — demonstrating webhook forgery requires a running merchant server processing lomi webhooks. The undiscoverability was verified by exhaustive search: WebhookVerify has zero imports across the entire codebase, zero README references, and zero test coverage.