CVE-2026-124566 · Other
NO FIX YET
The fuint project's Alipay payment callback handler, in the aliPayCallback function of ClientPayController.java, has a flaw that lets a remote manipulation enforce a different behavioral workflow than intended. The description does not state what an attacker gets beyond that, and the vendor did not respond to disclosure.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run fuint with the Alipay payment callback enabled are the ones to look at. The sources do not say which versions are affected beyond the commit range up to 36cc31b08d77facc94e8959afa02224891b4fe5f, and the project uses rolling releases with no fixed version. The sources do not say whether the callback is reachable without authentication.
Not affected if default-config
Who cares alipay, fuint, java, payments
Unknown from the sources.
No fix yet, per the sources.
A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.