: If an application (like new-api ) has a null or empty webhook secret by default, an attacker can generate their own HMAC-SHA256 signature using an empty key.

: Any HTTP client knowing the webhook URL can influence downstream business logic by faking subscription or payment events. 4. Potential Malware or False Positives

: Attackers manipulate user-controlled keys to bypass authorization checks, enabling them to make purchases through a victim's unique Stripe identifier. 3. n8n Stripe Trigger Node (CVE-2026-21894)

A critical vulnerability in the n8n automation platform allows unauthenticated parties to trigger workflows by sending forged Stripe webhook events.