Threats tagged 'ghsa-hcw8-82qq-9mcv'

Munshi (by Petpooja) versions before 2026-06-30 have a payment bypass vulnerability in the subscription payment webhook endpoint. The webhook at POST /api/payment/order/webhook lacks authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. This allows a remote, unauthenticated attacker to submit forged payment-success notifications that cause the backend to mark subscriptions as paid and active without actual payment.