New API < v0.12.10 - Stripe Webhook Bypass
New API < v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication.
PoC 已收录New API
CVSS—EPSS 0.75%