Threats affecting pkg:github/flexprice

FlexPrice versions up to 2.1.38 have an authentication bypass vulnerability in the HandleQuickBooksWebhook function. The flaw occurs because signature verification is skipped if the intuit-signature header is missing. This allows unauthenticated attackers who know a tenant and environment ID to replay forged payment notifications, potentially marking invoices as paid or overpaid.