Payments and entitlements

Webhook accepted without a signature check

The endpoint that marks orders paid or plans active trusts any request that looks like an event.

Termswebhook (a message a provider such as Stripe sends to your server when something happens, like a payment) · raw body (the request bytes exactly as sent; signature checks fail if a framework parses them first) · idempotency key (an identifier stored per processed event so a duplicate delivery changes nothing) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server)

criticalseverity if found in a releasesources verified 2026-09-21

Why AI-assisted code produces it

Stripe's docs state that without verification an attacker can send fake events to fulfil orders or grant access, and that the raw body is required for the check. Framework body parsing breaks the check silently, and the generated fix is to skip it.

Stripe signs every webhook event; without verification an attacker could send fake events to trigger order fulfilment or grant access. Official libraries reject events older than 5 minutes by default, endpoints may receive the same event more than once, and Stripe does not promise delivery order.

Source: Stripe docs, 2026-09 · verified 2026-09-21