Petpooja Munshi subscription payment webhook lacks authentication, allowing payment bypass
The payment confirmation door is unlocked, so paid features can be used without paying.
Summary
The subscription payment webhook in Munshi (Petpooja) has no authentication or signature checks, so an unauthenticated remote attacker can send a forged payment-success notice. The subscription can be activated without an actual payment; versions before 2026-06-30 are affected.
What to do
No fixed version is named in the sources. Check that the Munshi you run is newer than 2026-06-30, and read the vendor Petpooja's advisory.
Products and platforms
CVE IDs
Sources
- Write-up: medium.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen