Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 8.7 · petpoojaNVD modified 2026-11-02 18:54
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 3
- https://medium.com/@TheWildEye/payment-bypass-in-munshi-forging-a-phonepe-webhook-to-activate-an-unpaid-subscription-ce0806829fa4 technical-description, exploit
- https://www.petpooja.com/ product
- https://www.vulncheck.com/advisories/munshi-payment-bypass-via-unauthenticated-webhook-endpoint third-party-advisory