The vulnerability arises from insufficient validation of payment callback parameters and weak authentication controls on an API endpoint in the Manacle Technologies multi‑tenant ERP System. An attacker who can send a forged callback request can cause the application to establish an authenticated session for any desired user without completing legitimate payment verification, effectively bypassing account protection mechanisms.

Manacle Technologies’ Multi‑tenant ERP System is affected. No specific version information is provided.

The flaw carries a CVSS score of 9.3, indicating critical severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. A remote, unauthenticated attacker can manipulate the payment callback parameter to trigger the logic flaw, making exploitation relatively straightforward once the vulnerable endpoint is reachable. Given the high score and the ease of remote exploitation, the risk to systems that have not applied the vendor patch is substantial.