Signature verification bypass in FlexPrice QuickBooks webhook handler
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.
Summary
FlexPrice through 2.1.38 has an authentication bypass in the HandleQuickBooksWebhook function, which skips signature verification (CWE-347) when the intuit-signature header is omitted. An unauthenticated remote attacker who knows a tenant and environment ID can replay forged payment notifications, repeatedly adding payment amounts and marking invoices paid or overpaid. An exploit link is listed in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
The sources list no fixed version for flexprice.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-15 Threatist record created from CVE-2026-110765
- 2026-10-16 Priority changed: MEDIUM → LOW
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences