A vulnerability in Red Hat Quay's Stripe billing webhook handler allows unauthenticated attackers to forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint without validating the Stripe-Signature header. Exploitation can reset a namespace's build quota to its maximum and cause unsolicited billing emails to be sent to namespace administrators. The flaw exists even if the billing feature is disabled, though impact is reduced in self-hosted deployments using FakeStripe. No official patch is currently available; mitigation involves restricting network access to the webhook endpoint to trusted Stripe IPs or blocking it if unused.