CVE Alert: CVE-2026-119731 – Petpooja

Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.

**Risk verdict:** This is a high-priority revenue-integrity weakness: unauthenticated remote abuse could grant paid access, but urgency cannot be calibrated without exploitation and probability flags.

**Why this matters:** The likely impact is direct subscription revenue loss and unreliable billing records; repeated abuse could also undermine customer trust and complicate reconciliation. A public technical disclosure provides exploit detail, but does not establish active exploitation; KEV, SSVC and EPSS data were not supplied.

**Most likely attack path:** An attacker can reach the payment callback over the network with no account or user action, and little apparent operational friction. The affected trust boundary appears unchanged, so the likely impact is confined to the subscription service rather than enabling lateral movement into other systems.

**Who is most exposed:** Organisations using hosted subscription services with webhook-driven entitlement activation are most exposed, particularly where payment callbacks directly change account status.

Match activation events against successful transactions recorded by the payment provider.

Alert on callback requests lacking valid signatures or arriving from unexpected sources.

Review sudden activations, repeated callback attempts and order-status redirect access.

Reconcile entitlement changes with payment, refund and chargeback records.

Mitigation and prioritisation

Confirm provider remediation and apply its fix; obtain hosting-provider confirmation if the service is managed.

Until fixed, disable the callback or require verified signatures and independent provider-side payment confirmation.

Suspend or review entitlements without matching settled transactions; reconcile suspect orders.

Test callback handling in staging and coordinate changes with billing and support teams.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.