Xiaobei Webhook Endpoint Authentication Bypass

Xiaobei versions up to 5.5.2 are affected by a lack of authentication and signature validation on webhook endpoints.

Xiaobei allows unauthenticated attackers to inject arbitrary messages into the agent pipeline via the /webhook_worktool handler.

Exploiting unvalidated media URL fetching, attackers can perform server-side request forgery against internal services.