Unverified50% confidenceFactExact time
An attacker only needs to send a curl request to a webhook endpoint with a signature verification vulnerability, declaring a checkout.session.completed event and an arbitrary user ID, to upgrade themselves to a paid plan without a credit card or a Stripe account.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedStripe Webhook的安全性通过Signing Secret保障，Stripe用密钥对每个请求签名，服务器验证签名后才处理事件74% similarUnverifiedThe attack was a session hijacking attack (Session Grabber), in which the attacker bypassed password verification and directly took over accounts by stealing browser session cookies.70% similarUnverifiedPrompt injection or abnormal user input may allow an Agent to access data that should have been blocked or perform operations that should not have been executed, which is an architectural-layer vulnerability where permission checks are bypassed.69% similarUnverifiedBoth vulnerabilities are of the zero-click attack type, meaning attackers can execute arbitrary code in the user's running environment and steal sensitive credentials such as API keys without the victim clicking any link or downloading any file.68% similarUnverifiedWhen a maintainer's account is compromised, attackers may plant malicious code in the project and distribute it to all downstream users through subsequent updates.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1008227API
curl https://kongchang.com/api/v1/knowledge/claims/1008227MCP
get_claim(id=1008227)