Authentication Bypass in FlexPrice Payment Processing
CVE-2026-110765

8.2HIGH

Key Information:

Vendor

Flexprice

Status
Flexprice
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-110765?

FlexPrice versions up to 2.1.38 have a significant security flaw in their payment processing system specifically related to the QuickBooks Webhook integration. This vulnerability arises when the intuit-signature header is omitted, allowing unauthenticated attackers to bypass signature verification. By exploiting this weakness, attackers can replay forged payment notifications, leading to potential overpayment or incorrect status updates on invoices. This security issue poses a serious risk as it enables unauthorized users to manipulate payment data within the system.

Affected Version(s)

flexprice 0 <= 2.1.38

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-110765 - Proof of Concept

References

https://hackmd.io/@hieuPenguinnn/flexprice-quickbooks-web...
technical-descriptionexploit
https://github.com/flexprice/flexprice/blob/f27da32f84ee3...
technical-description
https://github.com/flexprice/flexprice
product

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.