CVE-2026-118377
High · 7.5CVSS
7.5
EPSS
0.2%
Published
Oct 28, 2026
CISA due date
—
The record
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63115 ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. CWE-345
- CVE-2026-119289 Zuke is a code-first, strongly typed build automation system for Deno. CWE-345
- CVE-2026-119422 Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that… CWE-345
- CVE-2026-93008 A flaw was found in dnsmasq. CWE-345
- CVE-2026-110985 A Kafka broker using SASL/OAUTHBEARER with the default validator… CWE-345
- CVE-2026-110952 A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled… CWE-345
- CVE-2026-103402 An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper… CWE-345
- CVE-2026-103330 The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the… CWE-345