What’s Vulnerable › Vulnerabilities

CVE-2026-110765: FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-15
• Weakness: CWE-347

Description

FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.

Affected products

• flexprice: through 2.1.38

References

• https://github.com/flexprice/flexprice
• https://github.com/flexprice/flexprice/blob/f27da32f84ee34bad4bf39a8d887af87fc3f30fc/internal/api/v1/webhook.go#L750
• https://hackmd.io/@hieuPenguinnn/flexprice-quickbooks-webhook-signature-bypass
• https://www.vulncheck.com/advisories/flexprice-through-2.1.38-quickbooks-webhook-signature-verification-bypass

Get alerted when CVE-2026-110765 or the next vulnerability affects your stack