FlexPrice Authentication Bypass Allows Webhook Signature Skipping
A high-severity flaw in FlexPrice permits attackers to bypass signature checks, enabling forged payment notifications that mark invoices as paid.
Key points
- CVE-2026-110765 affects FlexPrice versions through 2.1.38.
- The vulnerability allows unauthenticated attackers to replay forged payments.
- Attackers can mark invoices as paid or overpaid by omitting signature headers.
FlexPrice has a high-severity authentication bypass flaw in versions through 2.1.38. This defect allows unauthenticated attackers to manipulate payment statuses by skipping signature verification.
What happened
The vulnerability, tracked as CVE-2026-110765, exists in the HandleQuickBooksWebhook component of FlexPrice. According to the National Vulnerability Database, the flaw has a CVSS score of 8.2. The issue arises because the system fails to verify the `intuit-signature` header when it is omitted from incoming requests. This behaviour classifies the weakness under CWE-347, which relates to improper verification of cryptographic signatures.
Why it matters
An attacker who knows a specific tenant and environment ID can exploit this gap. They can replay forged payment notifications to the affected system. This allows them to repeatedly add payment amounts to existing records. Consequently, invoices can be marked as paid or overpaid without legitimate transaction backing. The impact is limited to environments running FlexPrice versions up to and including 2.1.38.
Next steps
- Identify if your infrastructure runs FlexPrice version 2.1.38 or earlier.
- Review webhook configurations to ensure signature validation is strictly enforced.
- Monitor for unauthorized changes to invoice payment statuses.
Detection notes
Teams usually detect this activity by analysing webhook logs for missing signature headers. Security operations should check whether payment status changes correlate with requests lacking cryptographic verification. Look for anomalies where invoices are marked paid without corresponding bank transaction records. Investigate any sudden shifts in outstanding balances. Containment moves involve temporarily disabling the webhook endpoint or enforcing strict header validation at the network layer until a fix is available. Monitor for repeated POST requests to the payment handler from unknown sources.
What to do and how to stay safe: FlexPrice
- Audit current FlexPrice installations to confirm version numbers against the affected list.
- Implement server-side checks that reject any webhook request missing the expected signature header.
- Enable detailed logging on payment processing endpoints to capture request headers and payloads.
- once the vendor provides an update, apply the patch immediately to close the authentication gap.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-110765?
The National Vulnerability Database rates the vulnerability as 8.2, which is considered high severity.
Which FlexPrice versions are affected by this flaw?
The vulnerability affects FlexPrice versions through 2.1.38, meaning any version up to and including that build is at risk.
How does an attacker exploit this vulnerability?
By omitting the intuit-signature header, attackers bypass verification and can replay forged payment notifications to alter invoice statuses.
