Munshi Payment Bypass via Unauthenticated Webhook

Executive Summary

This vulnerability is a payment bypass flaw in Munshi (by Petpooja) before 2026-06-30. The subscription payment webhook at POST /api/payment/order/webhook lacks authentication, cryptographic verification, and source validation. An attacker can forge a payment-success notification using an order ID obtained from a payment-status redirect URL, tricking the system into granting paid access without actual payment.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthenticated webhook endpoints handling payment notifications. Inspect network traffic for POST requests to /api/payment/order/webhook without authentication headers or signature verification. Monitor logs for suspicious subscription activations without corresponding payment provider confirmations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain unauthorized paid access to services without paying. This could lead to financial losses for the service provider and potential disruption of legitimate paid services. Users might experience unauthorized access or service interruptions if the system incorrectly grants access.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately disable the affected webhook endpoint or restrict access via IP whitelisting. Implement cryptographic signature verification for webhook payloads and require authentication tokens. Verify all subscription activations by cross-checking with the payment provider's server before granting paid access.

Useful 0 Not Useful 0