Vulnerable code sample

from typing import Dict, Optional

# Mock objects for context
from aiohttp import web

class BaseHandler: ...
class MempoolHandler(BaseHandler): ...
class TransactionHandler(BaseHandler): ...
class TONAPI:
    def __init__(self, api_key: str):
        self.api_key = api_key

class TonapiWebhookDispatcher:
    def __init__(self, tonapi: TONAPI):
        self.tonapi = tonapi
        self._handlers: Dict[str, BaseHandler] = {}
        self._tokens: Dict[str, str] = {}

    def setup(self, handler: BaseHandler, path: Optional[str] = None) -> None:
        token = self.tonapi.api_key
        if isinstance(handler, MempoolHandler):
            webhook_path = "/v1/mempool/webhook"
            self._handlers[webhook_path] = handler
            self._tokens[webhook_path] = token
        elif isinstance(handler, TransactionHandler):
            webhook_path = "/v1/transaction/webhook"
            self._handlers[webhook_path] = handler
            self._tokens[webhook_path] = token
        elif path:
            # VULNERABLE: The custom path is used to register the handler, but the token is not stored.
            self._handlers[path] = handler

    async def _handle_request(self, request: web.Request) -> web.Response:
        token = self._tokens.get(request.path)
        if token:  # This authentication check is skipped for custom paths
            auth_header = request.headers.get("Authorization")
            if not auth_header or auth_header != f"Bearer {token}":
                raise web.HTTPUnauthorized()

        handler = self._handlers.get(request.path)
        if handler:
            return web.Response(text="OK")
        return web.Response(status=404)