FlexPrice up to version 2.1.38 contains an authentication bypass in its QuickBooks webhook handler. The bypass occurs when the ‘intuit-signature’ header is omitted, allowing the handler to skip signature verification. Unauthenticated attackers who know the tenant and environment IDs can replay forged payment notifications, repeatedly adding payment amounts and marking invoices as paid or overpaid, which can lead to financial fraud and revenue loss.

The vulnerability affects the FlexPrice application distributed by FlexPrice, version 2.1.38 and earlier. Systems running any of those versions with the QuickBooks webhook endpoint enabled are at risk. There are no additional vendor or product identifiers beyond FlexPrice noted in the CNA data.

The CVSS score of 8.2 classifies the issue as high severity. The EPSS score is not available, but the lack of authentication and dependence on missing headers make the exploitation straightforward for an attacker who can send crafted webhook requests. Since the vulnerability is not listed in the CISA KEV catalog, there is currently no known active exploitation, yet the low attack complexity and potential financial impact make it a priority to patch.