FlexPrice: Authentication bypass in QuickBooks webhook signature verification

Summary

FlexPrice through version 2.1.38 skips signature verification in its QuickBooks webhook handler when the intuit-signature header is omitted. An unauthenticated attacker who knows a valid tenant and environment ID can send forged payment notifications, which repeatedly add payment amounts and can mark invoices as paid or overpaid. Only deployments with the QuickBooks integration enabled are affected.

Affected

• FlexPrice up to and including 2.1.38 (cloud and self-hosted)
• Only installations with the QuickBooks integration enabled
• Unknown whether the webhook verifier token is configured in your setup

Fixed in

Unknown. A pull request (#3191) addressing the issue has been referenced, but its merge and the first release containing it could not be confirmed.

Workaround

• No vendor-issued workaround found.
• Make sure every QuickBooks connection has a webhook verifier token configured, as signature validation only applies when a token is set.
• Review webhook logs for QuickBooks payment events received without an intuit-signature header.
• Restrict access to the webhook endpoint where your network allows it.

Exploitation

• No evidence of exploitation in the wild found; not listed in CISA KEV.
• A third-party write-up describing the bypass exists.
• EPSS score 0.00225 (low).

Our recommendation

• Check whether FlexPrice is in use in your organisation and whether the QuickBooks integration is enabled.
• Confirm a verifier token is set for every QuickBooks connection and update to a version that includes the fix once confirmed by the vendor.
• Reconcile recently paid or overpaid invoices against QuickBooks and review webhook logs for unsigned requests.
• Ask FlexPrice for a security advisory and confirmation of affected deployments.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record mirror (Vulners) vulners.com
• VulnCheck advisory www.vulncheck.com
• FlexPrice GitHub repository github.com
• Vulnerable webhook code (commit f27da32) github.com
• Fix pull request #3191 github.com
• FlexPrice QuickBooks connection setup docs.flexprice.io
• FlexPrice webhook signature verification docs.flexprice.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:15.