{"id":"CVE-2026-119731","title":"Munshi Payment Bypass via Unauthenticated Webhook Endpoint","summary":"Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source vali…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-345","CWE-306"],"vendor":"Petpooja","product":"Munshi","affected":["Munshi <= 2026-06-30"],"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T18:54:28.988Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119731","references":[{"url":"https://medium.com/@TheWildEye/payment-bypass-in-munshi-forging-a-phonepe-webhook-to-activate-an-unpaid-subscription-ce0806829fa4","label":"Researcher Disclosure"},{"url":"https://www.petpooja.com/","label":"Vender Homepage"},{"url":"https://www.vulncheck.com/advisories/munshi-payment-bypass-via-unauthenticated-webhook-endpoint","label":"VulnCheck Advisory: Munshi Payment Bypass via Unauthenticated Webhook Endpoint"}],"tags":["cve.org"],"epss":0.0027,"epssPercentile":0.19342,"ingestedAt":"2026-11-05T19:30:42.778Z","slug":"CVE-2026-119731","body":"## Overview\n\nMunshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.\n\n## Affected\n\n- `Munshi <= 2026-06-30`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}