CVE-2026-110765: FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly add payment amounts, marking invoices paid or overpaid.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
FlexPrice deployments through version 2.1.38 that process QuickBooks webhooks are exposed. An attacker must know a valid tenant ID and environment ID.
What does an attacker need to do to exploit the issue?
The attacker can omit the intuit-signature header so that signature verification is skipped, then submit forged payment notifications. No authentication or user interaction is required, although exploitation has high attack complexity.
What is the business impact of a successful attack?
Forged notifications can be replayed repeatedly to add payment amounts. This can cause invoices to be marked paid or overpaid, affecting payment integrity.
How can defenders identify attempted exploitation?
Review QuickBooks webhook requests for missing intuit-signature headers and investigate payment notifications that were replayed or resulted in repeated payment additions. Focus on invoices unexpectedly marked paid or overpaid.