CVE-2026-119731 Details

A payment bypass vulnerability has been identified in Munshi, a product by Petpooja, affecting versions released prior to June 30, 2026. The vulnerability resides in the subscription payment webhook at POST /api/payment/order/webhook. It arises from the absence of webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. This allows remote, unauthenticated attackers to send forged payment-success notifications, referencing orders obtained from the payment-status redirect URL. As a result, the backend erroneously marks the subscription as paid and active, granting access without a legitimate payment.