{"id":"CVE-2026-118377","kind":"vulnerability","aliases":["CVE-2026-118377"],"related":[],"title":"mews/pos: forged payment callbacks let attackers complete unpaid orders","description":"mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.","summary":"The mews/pos PHP payment library, through version 2.0.0, skips hash verification on bank callbacks from GarantiPos, PayForPos and InterPos 3D handlers. An unauthenticated attacker can post tampered status, amount or order ID fields and have an order marked as paid without paying.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["e-commerce","mews-pos","package","payments","php"],"not_affected_if":["library-not-used","other-payment-gateway"],"how_to_check":"- Check the installed version of `mews/pos` in `composer.lock` or with `composer show mews/pos`\n- Look for callback handlers for GarantiPos, PayForPos or InterPos that do not call `check3DHash()` before marking an order paid\n- unknown","fix":"- Upgrade `mews/pos` to a version later than `2.0.0` once a patched release is confirmed (the sources do not name one)\n- Until patched, verify the bank's hash on every 3D callback before updating order status\n- unknown","status":"open","published_at":"2026-10-28T03:17:14+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:22+00:00","updated_at":"2026-10-28T03:32:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T03:32:22Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `mews/pos` to a version later than `2.0.0` once a patched release is confirmed (the sources do not name one)\n- Until patched, verify the bank's hash on every 3D callback before updating order status\n- unknown","reach":"internet","title":"mews/pos: forged payment callbacks let attackers complete unpaid orders","impact":"high","summary":"The mews/pos PHP payment library, through version 2.0.0, skips hash verification on bank callbacks from GarantiPos, PayForPos and InterPos 3D handlers. An unauthenticated attacker can post tampered status, amount or order ID fields and have an order marked as paid without paying.","category":"package","nicknames":[],"who_cares":["php","mews-pos","payments","e-commerce"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker marks unpaid orders as paid, completing purchases for free","analyst_note":"Confirm the patched version and whether check3DHash() is enforced in the fixed release; source is NVD only at https://nvd.nist.gov/vuln/detail/CVE-2026-118377","how_to_check":"- Check the installed version of `mews/pos` in `composer.lock` or with `composer show mews/pos`\n- Look for callback handlers for GarantiPos, PayForPos or InterPos that do not call `check3DHash()` before marking an order paid\n- unknown","needs_analyst":true,"not_affected_if":["other-payment-gateway","library-not-used"],"who_is_affected":"Sites that take card payments through mews/pos with the GarantiPos, PayForPos or InterPos gateways are exposed, because the callback URL is reachable by anyone on the internet. Stores that use other gateways or do not use this library can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000657,"input_tokens":3348,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118377':12A,15A '-2026':11A,14A '2.0.0':32B,69C '3d':44B,94C,97C 'allow':79C 'amount':53B,107C 'attack':6A,48B,81C,103C 'authent':76C 'bank':37B 'callback':4A,38B,89C 'check3dhash':101C 'commerc':18B 'complet':7A,113C 'contain':70C 'cve':10A,13A 'data':75C 'e':17B 'e-commerc':16B 'field':57B,111C 'forg':2A,83C 'garantipo':40B,90C 'handler':45B,99C 'hash':34B 'host':98C 'id':56B,110C 'insuffici':72C 'interpo':43B,93C 'let':5A,102C 'librari':29B 'mark':62B 'mew':20B 'mews-po':19B 'mews/pos':1A,26B,67C 'order':9A,55B,61B,109C,114C 'packag':22B 'paid':64B 'pay':66B,95C,116C 'payforpo':41B,91C 'payment':3A,23B,28B,84C 'php':24B,27B 'pos':21B 'post':50B,104C 'result':85C 'skip':33B,100C 'status':52B,106C 'submit':87C 'tamper':51B,105C 'unauthent':47B,80C 'unpaid':8A 'unverifi':88C 'verif':35B,73C 'version':31B 'vulner':77C 'without':65B,115C","nicknames":[],"mitigations":[],"who_affected":"Sites that take card payments through mews/pos with the GarantiPos, PayForPos or InterPos gateways are exposed, because the callback URL is reachable by anyone on the internet. Stores that use other gateways or do not use this library can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118377","severity":null,"published_at":"2026-10-28T03:17:14+00:00","modified_at":"2026-10-28T03:17:14+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}