mews/pos CVE-2026-118377

Exploitation requires that the target application use the mews/pos library (≤2.0.0) with the GarantiPos, PayForPos, or InterPos gateway in 3D Pay or 3D Host payment mode, since only those handlers omit the check3DHash() call; the attacker must be able to reach the application's payment return/callback endpoint and submit a callback with forged status, amount, or order ID fields. No authentication is required (PR:N) and no user interaction is needed (UI:N), and the vulnerable path is the default behavior for those handlers rather than a non-default setting. The practical limiting factor is deployment scope: sites not using these three gateways in these two 3D models, or already on a patched version where is3DHashCheckDisabled() is false, are not exploitable.

Signals mostly agree that this is a genuine but scope-limited priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes trivial remote, unauthenticated exploitation with no special attack requirements, and the source diff confirms the mechanism: affected 3D Pay / 3D Host handlers never call check3DHash(). Impact is narrow and integrity-only (VI:H, VC:N, VA:N) - the result is payment/order forgery (financial fraud), not data theft or outage, which is why the 8.7 score sits just below critical. Mitigating signals: no EPSS score is provided, the CVE is not listed in CISA KEV, and no confirmed working exploit code is in the input; the vuln.today Decision label is 'this_week' (not act_now/emergency), consistent with high severity but no evidence of mass exploitation. A vendor patch is available. Net: for the limited population running mews/pos with GarantiPos, PayForPos, or InterPos in 3D Pay/3D Host mode, this is a real and easily abused fraud risk that should be patched promptly; for everyone else it does not apply. EPSS and KEV data are absent from the input and could not be independently confirmed.

An attacker places an order on an e-commerce site that uses mews/pos with GarantiPos, PayForPos, or InterPos in 3D Pay or 3D Host mode, then POSTs a crafted callback to the site's return URL carrying a success status and tampered amount or order ID fields. Because the handler skips check3DHash(), the forged callback is accepted as genuine and the order is completed without any real payment. Exploitation is remote, unauthenticated, and low-complexity (AV:N/AC:L/PR:N/UI:N); no confirmed working public exploit is in the input, though a VulnCheck advisory and the fix PR are publicly referenced.