Stripe · Report #1328278
User can pay using archived price by manipulating the request sent to `POST /v1/payment_pages/for_plink`
Validstatus
mediumseverity
100upvotes
19 Jan 2022disclosed
Summary
@gregxsunday discovered a way to purchase a product with an archived price using a payment link. The bypass was possible because of missing validation. A change was shipped to ensure both the payment link and price are active.
Note: This bug was accepted and received before our minimum bounty amounts were increased on August 25, 2021.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.