EUVD-2026-119800Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged client
-
ExploitManipulate Alipay payment callback request
-
ExecutionBypass expected payment-confirmation workflow
-
ImpactAlter order/payment integrity state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Workflow enforcement
|
| Exploitation Conditions | Requires a running fuint instance with Alipay payment integration configured and the client payment flow in use, plus a low-privileged authenticated account (PR:L) able to reach the aliPayCallback endpoint; the attack subverts the payment-confirmation behavioral workflow (CWE-841) over the network with low complexity (AV:N/AC:L/UI:N). Limiting factors that reduce realistic risk: authentication is required (not fully unauthenticated), the Alipay callback feature must be deployed/enabled, and impact is confined to low integrity effect (VI:L) with no confidentiality (VC:N) or availability (VA:N) loss. The precise trigger (e.g., missing signature/validation) is not described in the available sources. |
| Impact | This is a medium-severity, moderate-priority issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a remotely reachable, low-complexity flaw, but impact is narrow: only integrity is affected and only at VC:N/VI:L/VA:N, i.e. no confidentiality or availability loss and limited integrity effect, yielding a 5.3 base score. PR:L means some authenticated access is required, which further constrains the attacker population. No EPSS score was provided, there is no CISA KEV listing (not actively exploited per available data), and no confirmed public exploit code was supplied - only VulDB catalog/submission links. The vuln.today decision label is 'this_month', consistent with a real-but-not-emergency priority. One signal conflict exists: the input Tag 'Information Disclosure' implies confidentiality impact, yet the supplied CVSS vector sets VC:N (no confidentiality) and only VI:L, so the tag likely mislabels an integrity/workflow-bypass issue in an Alipay payment callback (CWE-841) - verify against the vendor/source. Because the product uses a rolling-release model, no fixed version can be pinned, which complicates remediation tracking. |
| Exploit ScenarioDerived | An attacker with a low-privileged account on a fuint deployment interacts with the client payment flow and manipulates the Alipay callback handled by aliPayCallback in ClientPayController.java, subverting the expected payment-confirmation workflow (CWE-841) to alter order/payment state without a legitimate completed transaction. The attack is remote and low-complexity per the CVSS vector, but the exact trigger mechanism is not described in the available sources, and no confirmed working exploit code was provided. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 09, 2026
Improper enforcement of behavioral workflow in the Alipay callback handler (aliPayCallback in ClientPayController.java) of fushengqian's fuint payment platform lets a low-privileged authenticated user manipulate the payment-confirmation flow over the network, producing a limited integrity impact (CVSS 5.3, VI:L) with no confidentiality or availability loss. Because fuint ships as a rolling release, no affected or fixed version numbers can be pinned; the issue is confirmed present up to commit 36cc31b08d77facc94e8959afa02224891b4fe5f, and instances must have Alipay integration configured and the client payment flow in use to be exposed. No public exploit code was identified at time of analysis, and the vendor did not respond to the disclosure, so no vendor-released patch has been identified; the trigger mechanism itself (for example whether callback signature or state validation is missing) is not described in the available sources.
RemediationAI
No vendor-released patch has been identified at time of analysis: the maintainers were contacted early but did not respond, and the rolling-release model means there is no tagged fixed version to cite, so operators should track upstream commits past 36cc31b08d77facc94e8959afa02224891b4fe5f and re-review aliPayCallback in ClientPayController.java before redeploying. Until a fix lands, compensating controls aimed at the callback path are the practical option, each with trade-offs: restrict network access to the Alipay callback endpoint so only Alipay's notification sources can reach it (reduces exposure but breaks legitimate callers if source ranges change or are misconfigured); if the application does not already do so, enforce server-side verification of Alipay notification signatures and validate each notification against the expected order amount and current order state before any status change (defends the workflow, but requires code changes that must be maintained across updates); and reconcile payment status out-of-band against Alipay settlement records, alerting on state transitions that lack a verified notification (detects abuse rather than preventing it, and adds operational overhead). Restricting or disabling the client payment flow entirely removes the exposure but stops payment processing. The public references https://vuldb.com/vuln/432898 and https://vuldb.com/cve/CVE-2026-124566 should be monitored for an upstream fix or vendor statement.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fuint is a Java-based open-source membership/point-of-sale and payment platform that integrates with Alipay; the affected code path is the Alipay asynchronous notification handler, aliPayCallback, inside ClientPayController.java. The weakness is classified as CWE-841 (Improper Enforcement of Behavioral Workflow): the application is expected to enforce a strict sequence of payment states - order created, payment notification received, order marked paid - but an actor able to interact with the callback endpoint can subvert that sequence so the workflow reaches a state it should not, with a low integrity impact on the resulting records. Per the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), the attack is network-reachable, low complexity, requires no user interaction, and requires a low-privileged authenticated account; the CPE entry cpe:2.3:a:fushengqian:fuint:*:*:*:*:*:*:*:* reflects the project's rolling-release model, under which no discrete affected or fixed version boundary is published. The specific condition that permits the workflow to be bypassed is not documented in the supplied sources, so the precise trigger (signature verification, order-status checking, or replay handling) remains unconfirmed; the preconditions confirmed by the assessment are a running fuint deployment with Alipay payment integration enabled and the client payment flow in active use.
Know when Fuint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Remotely reachable low-complexity callback endpoint (AV:N/AC:L) requiring a low-privileged account (PR:L), affecting only payment-workflow integrity (I:L) with no confidentiality or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
DescriptionCVE.org
A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
An insecure direct object reference in Fuint through commit 57ec018 lets authenticated members retrieve other members' b
An integrity-only state manipulation flaw in the fuint order-management platform lets an authenticated low-privilege use
Improper access control in fuint's MerchantOrderController confirm action allows an authenticated low-privileged user to
GitHub PoC
Exploit-DB