CVE-2026-33661

Katalog CVE

CVSS 7.5 · High EPSS 0,67%

Kerentanan Authentication Bypass by Spoofing pada yansongda pay. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc exploit · advisory vendor
• https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f patch
• https://github.com/yansongda/pay/releases/tag/v3.7.20 release notes