{"affected":[{"defaultStatus":"unaffected","product":"Munshi","source":"CNA: VulnCheck","vendor":"Petpooja","versions":[{"lessThanOrEqual":"2026-06-30","status":"affected","version":"0","versionType":"date"}]}],"cveId":"CVE-2026-119731","cwes":["CWE-345","CWE-306"],"description":"Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://medium.com/@TheWildEye/payment-bypass-in-munshi-forging-a-phonepe-webhook-to-activate-an-unpaid-subscription-ce0806829fa4"}],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":7.5,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}],"modifiedAt":1793645668988,"publishedAt":1793645668988,"references":[{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://medium.com/@TheWildEye/payment-bypass-in-munshi-forging-a-phonepe-webhook-to-activate-an-unpaid-subscription-ce0806829fa4"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://www.petpooja.com/"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/munshi-payment-bypass-via-unauthenticated-webhook-endpoint"}],"remediation":[],"revision":"bb1dee34637a36bf14e51d21a013d4284ce8e9d2d2f17bb4621afaa39bee8a5a","sources":[{"modifiedAt":1793645668988,"name":"CNA: VulnCheck","retrievedAt":1793646539472,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119731"}],"ssvc":null,"status":"published","title":"Munshi Payment Bypass via Unauthenticated Webhook Endpoint","updatedAt":1793646539472}