CVE-2026-101275 · Vendor
NO FIX YET
A ticketing system's integration with the Adyen payment service did not check that a payment status response belonged to the payment being processed. An attacker could reuse a successful status from one payment to obtain multiple valid tickets for the price of one.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Affects a ticketing or shop application that uses its own Adyen payment integration and trusts payment status responses without matching them to the specific payment. Systems that use Adyen's hosted checkout with verified webhooks, or that do not integrate this way, are not described as affected. The sources do not name the vendor product.
Not affected if hosted-payments-without-custom-integration
Who cares adyen, payments, ticketing
Unknown from the sources.
No fix yet, per the sources.
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.