A vulnerability in certain API endpoints allowed creation of order payments referencing gift cards by using an unchecked auto-incremented internal ID. This flaw enabled attackers to reference gift cards from different organizers and obtain their secret. Although the gift card itself was not charged, triggering a refund on the payment could increase the gift card's value.