Skip to content
Threat Feed

Product

Stripe Webhook

1 brief RSS
critical advisory

Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

A vulnerability in the Stripe webhook handler allows an unauthenticated attacker to forge webhook events and credit arbitrary quota to their account without payment, stemming from an empty StripeWebhookSecret and lack of PaymentMethod validation, enabling cross-gateway exploitation.

Stripe Webhook stripe webhook signature-bypass quota-fraud
2r 1t