---
id: "CVE-2026-118377"
kind: "vulnerability"
aliases: ["CVE-2026-118377"]
title: "mews/pos: forged payment callbacks let attackers complete unpaid orders"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["e-commerce", "mews-pos", "package", "payments", "php"]
not_affected_if: ["library-not-used", "other-payment-gateway"]
published_at: "2026-10-28T03:17:14+00:00"
first_seen_at: "2026-10-28T03:31:02+00:00"
updated_at: "2026-10-28T03:32:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118377", "first_seen_at": "2026-10-28T03:31:02+00:00"}]
---

# mews/pos: forged payment callbacks let attackers complete unpaid orders

The mews/pos PHP payment library, through version 2.0.0, skips hash verification on bank callbacks from GarantiPos, PayForPos and InterPos 3D handlers. An unauthenticated attacker can post tampered status, amount or order ID fields and have an order marked as paid without paying.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of `mews/pos` in `composer.lock` or with `composer show mews/pos`
- Look for callback handlers for GarantiPos, PayForPos or InterPos that do not call `check3DHash()` before marking an order paid
- unknown

## Fix

- Upgrade `mews/pos` to a version later than `2.0.0` once a patched release is confirmed (the sources do not name one)
- Until patched, verify the bank's hash on every 3D callback before updating order status
- unknown

## Timeline

- 2026-10-28T03:31:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118377

## From the sources

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_