What is the CVSS score of CVE-2026-13462?

CVE-2026-13462 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of PayRange are affected by CVE-2026-13462?

PayRange Android app versions 7.0.7 and below contain improper TLS certificate validation in embedded webviews that allows network-positioned attackers to intercept and decrypt sensitive user data…

How to fix or mitigate CVE-2026-13462?

Within 24 hours: Identify all systems and user populations using PayRange Android app versions 7.0.7 or below; communicate advisory to affected users and restrict app usage to trusted, controlled networks only. Within 7 days: Implement network-level monitoring to detect suspicious certificate activity and anomalous transaction patterns; develop credential rotation procedures for affected user base. Within 30 days: Prepare controlled patch deployment procedures and establish vendor communication for immediate rollout once PayRange releases a fixed version; evaluate alternative payment solutions if patch timeline extends beyond 60 days.

PayRange CVE-2026-13462

EUVD-2026-42637 HIGH

2026-07-09 cret@cert.org

GHSA-wpmg-2gv8-722g

Authentication Bypass Google

7.5

CVSS 3.1 · Vendor: cert

Severity by source

Vendor (cert) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

MITM network positioning is required to abuse the cert bypass, so AC:H rather than AC:L; impact is confidentiality-only (C:H) as the attacker reads transmitted data with no integrity/availability effect described.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (cert).

CVSS VectorVendor: cert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 20:23 vuln.today

CVSS changed

Jul 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVSS changed

Jul 09, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jul 09, 2026 - 17:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 09, 2026 - 17:16 cve.org

HIGH 7.5

DescriptionCVE.org

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends.

AnalysisAI

Sensitive data exposure in the PayRange Android app (versions 7.0.7 and below) stems from improper TLS certificate validation in the app's embedded webviews, which accept invalid or attacker-controlled certificates. A network-positioned (man-in-the-middle) attacker can therefore decrypt and capture information users submit through those webviews, such as account or payment-related data. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CERT/CC advisory (VU#152953) is the primary reference.

Technical ContextAI

The root cause is the CWE-295 (Improper Certificate Validation) class, explicitly referenced in the NVD data via cwe.mitre.org/data/definitions/295.html even though the CVE record lists CWE as N/A. On Android, WebView TLS validation is typically enforced by the app's WebViewClient.onReceivedSslError() handler; when an app overrides this callback to call handler.proceed() unconditionally (or otherwise trusts all certificates), the platform's certificate chain and hostname checks are bypassed. This lets any certificate - including a self-signed or attacker-generated one - be accepted, collapsing the confidentiality guarantee of HTTPS for content rendered in the app's webviews. The affected component is the PayRange mobile payment application for Android; no CPE strings were supplied in the input beyond the version string 'PayRange 7.0.7'.

RemediationAI

Upgrade the PayRange Android app to a release later than 7.0.7 that enforces proper certificate validation; no exact fixed version number is stated in the provided data, so consult the CERT/CC advisory at https://kb.cert.org/vuls/id/152953 for the vendor-confirmed patched build before deploying. Until a fixed version is confirmed and installed, instruct users to avoid submitting sensitive information through the app while on untrusted or public Wi-Fi and to prefer a trusted cellular or VPN connection, which prevents an attacker from occupying the MITM position needed to abuse the certificate bypass (trade-off: relies on user behavior and does not remediate the underlying code flaw). Enterprise/MDM administrators can block or restrict the vulnerable app versions until the update is applied.