Stripe webhook replay tolerance is left at the default or set to a bounded value (600 seconds or less)

Stripe signs timestamp.payload and the SDK rejects events whose timestamp is outside a tolerance window, 300 seconds by default, so a captured request cannot be replayed hours later. The tolerance is the fourth argument to constructEvent(payload, header, secret, tolerance), and the failure is overriding it to make a local test or a clock-skew error go away: 0, a negative number, Infinity, or a huge literal. Passing 0 is the trap that matters in practice because several SDKs treat a falsy tolerance as "do not check the timestamp", and an assistant that was asked to "fix the timestamp outside tolerance error" will often disable the check rather than fix the server clock. With replay protection off, any signed event an attacker observes (a leaked log line, a proxy capture, a staging copy of production traffic) can be re-sent to re-run fulfillment or entitlement logic. This is CWE-294 (Authentication Bypass by Capture-replay) and CWE-345, and it is independent of whether the signature itself is verified: the signature stays valid forever once the window is disabled. Stripe documents the default tolerance and recommends against disabling timestamp checks.

Remove the tolerance argument so the SDK default (300 seconds) applies, or pass an explicit value of 600 seconds or less. If you hit "Timestamp outside the tolerance zone" errors, fix the server clock (NTP) or make sure you are verifying the unmodified raw body; do not widen the window.

// default tolerance (300s) - preferred
event = stripe.webhooks.constructEvent(body, sig, secret)
// or an explicit bounded value
event = stripe.webhooks.constructEvent(body, sig, secret, 300)