The advisory calls this a missing HMAC-SHA256 check on Bitbucket webhooks, but that's the symptom, not the disease. The real vulnerability is that X-Event-Key—a caller-supplied HTTP header—determined which provider's validation logic executed. An attacker didn't need to forge Bitbucket signatures because they could route execution through a path that never asked for them. This is indirect access at its core: by controlling the routing decision, you bypassed not one but three independent security controls (HMAC verification, secret configuration requirements, and component matching logic) without directly compromising any of them.
The more alarming dimension is the cross-provider commit SHA injection. If an attacker could inject a commit SHA from a repository they control into a build triggered for a legitimate component, they potentially achieved code execution in pipelines configured for entirely different sources. The component matching logic trusted commit references downstream of the handler without re-validating provenance—a trust proxy assumption that compounds across architectural layers.
Your immediate priorities: First, determine whether the fix redesigned provider selection to use server-controlled logic (e.g., mapping incoming IP or repository URL to provider type) rather than caller-supplied headers. If routing still depends on X-Event-Key or equivalent headers, the same bypass exists through GitHub or GitLab provider values. Second, verify whether component matching now independently validates commit SHA provenance rather than trusting handler-passed references. Third, audit every other webhook handler and routing endpoint in your codebase for identical patterns—untrusted input controlling security decisions is a recurring anti-pattern, and fixing one handler doesn't fix the engineering culture that produced it.
The CVSS 5.3 score is a structural failure, not an accurate assessment. This vulnerability collapses three trust boundaries simultaneously and enables pipeline-level code execution. Score it as critical in your internal triage, regardless of the advisory rating.