CVE-2026-119731 Munshi Payment Bypass via Unauthenticated Webhook Endpoint
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-119731?
CVE-2026-119731 is a high-severity vulnerability in Petpooja Munshi, published on 2 Nov 2026.
Official description
Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.
Which versions are affected by CVE-2026-119731?
How do I fix CVE-2026-119731?
No fix has been published for CVE-2026-119731 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-119731 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119731 exists.
Sources
Also known as GHSA-hcw8-82qq-9mcv.