Payment Bypass Vulnerability in Munshi by Petpooja

CVE-2026-119731

What is CVE-2026-119731?

The Munshi application, developed by Petpooja, is susceptible to a payment bypass vulnerability due to deficiencies in its subscription payment webhook. Specifically, the webhook lacks proper authentication and verification mechanisms, including cryptographic signature validation and source validation. This flaw allows a remote attacker to forge a payment-success notification by manipulating the payment-status redirect URL, tricking the backend system into erroneously marking an unpaid subscription as active. Without effective server-side confirmation with the payment provider, this vulnerability poses a significant risk of unauthorized access to paid services. For further details, please refer to the research and advisory documents.

References