A remote attacker can submit a forged payment‑success notification to the Munshi subscription payment webhook at POST /api/payment/order/webhook. The endpoint lacks authentication, cryptographic signature verification, source validation, and independent confirmation with the payment provider. This allows the backend to mark a subscription as paid/active and grant paid access without an actual successful payment. The flaw is classified as CWE-306 and CWE-345, representing missing authentication for critical functions and missing authentication for security‑relevant operations, respectively.

Petpooja’s Munshi application prior to 2026-06-30 is affected. The vulnerability exists in the webhook handling of subscription payments and can be exploited by any user able to submit data to the endpoint.

The vulnerability has a CVSS score of 8.7, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and unauthenticated via an HTTP POST request to the webhook. Because the endpoint does not validate the source or signature, an attacker can forge a payment notification at will, leading to unauthorized access and potential financial loss for the service provider and customers.