CVE-2026-129144 · Other
NO FIX YET
paicoding 1.0.3, a Java forum and content platform, generates payment confirmation codes from a small counter. An authenticated attacker can guess a valid code and mark their own payment as paid, unlocking paywalled articles.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running paicoding 1.0.3 that sell paid articles or memberships are exposed, because the payment confirmation code can be guessed. The attacker needs a user account. Sites that do not use paid content or the payment callback are not affected.
Not affected if no-paid-content, other-version
Who cares java, paicoding, self-hosted
1.0.3 is affected per the advisoryNo fix yet, per the sources.
paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by guessing weak payment confirmation codes. Attackers can start a payment, enumerate roughly 2000 IdUtil.genPayCode counter values, and submit the matching verifyCode to the unauthenticated callback to mark it paid.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.