CVE-2026-64868: New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

Unauthenticated payment webhook endpoints could read and log the entire request body before validating the webhook signature. When a payment webhook was enabled, an unauthenticated attacker could send oversized requests to public callback endpoints and force excessive memory use and log growth before the request was rejected.

Affected public endpoints included:

• POST /api/stripe/webhook
• POST /api/creem/webhook
• POST /api/waffo/webhook

This issue did not allow forging successful payments, because signature validation still guarded the payment processing logic. The vulnerable behavior was the expensive unauthenticated request processing that occurred before signature validation.