Live › vulnerability › CVE-2026-118377
Go to dashboardThe mews/pos PHP payment library, through version 2.0.0, skips hash verification on bank callbacks from GarantiPos, PayForPos and InterPos 3D handlers. An unauthenticated attacker can post tampered status, amount or order ID fields and have an order marked as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Sites that take card payments through mews/pos with the GarantiPos, PayForPos or InterPos gateways are exposed, because the callback URL is reachable by anyone on the internet. Stores that use other gateways or do not use this library can skip it.
No product ranges from the sources yet.
mews/pos in composer.lock or with composer show mews/poscheck3DHash() before marking an order paidmews/pos to a version later than 2.0.0 once a patched release is confirmed (the sources do not name one)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
This page as .md · .json · in your agent: get_signal("CVE-2026-118377")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.