Which versions of pretix-oppwa are affected by CVE-2026-13603?

The pretix-oppwa payment plugin contains a critical vulnerability that enables remote attackers to intercept and steal Oppwa API access tokens through manipulated URL parameters, potentially…. A patch is available.

How to fix or mitigate CVE-2026-13603?

Within 24 hours: identify all pretix instances with active Oppwa payment processing; Within 7 days: upgrade all identified instances to pretix version 2026.5.3 or later; Within 30 days: audit Oppwa API access logs for unauthorized activity and rotate any potentially compromised credentials.

pretix-oppwa CVE-2026-13603

Q: What is the CVSS score of CVE-2026-13603?

CVE-2026-13603 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-40958 CRITICAL

Improper Input Validation (CWE-20)

2026-07-01 rami.io

GHSA-29fq-jc8m-8rq2

Information Disclosure Pretix Pretix Oppwa

9.0

CVSS 4.0 · Vendor: rami.io

Severity by source

Vendor (rami.io) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Unauthenticated network attacker manipulates resourcePath during the payment return to exfiltrate the provider API token; scope changes to the payment provider system (S:C), with high confidentiality and limited integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (rami.io).

CVSS VectorVendor: rami.io

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 15:16 EUVD

Analysis Generated

Jul 01, 2026 - 14:21 vuln.today

DescriptionCVE.org

The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the payment provider back to our system with a query parameter like ?resourcePath=/v1/checkouts/{checkoutId}/payment in the URL. Our system is then supposed to fetch the status of the transaction from the URL given by baseUrl + resourcePath.

Our plugin pretix-oppwa did so insecurely by concatenating the parameter form the URL to the base domain of the API without further validation and, critically, without a / at the end of the baseUrl. Therefore, an attacker could inject a resourcePath argument in a way that causes pretix to call a different server instead. Since the request includes the access token (API key) of the Oppwa account, this would leak the access token, giving access to data contained in the payment provider's system. This is fixed with the release today by strictly validating the given API URL.

After installing the update, we recommend asking your payment provider for a new access token and updating it in pretix.

AnalysisAI

Server-side URL manipulation in the pretix-oppwa payment plugin (fixed in pretix 2026.5.3) lets a remote attacker exfiltrate the Oppwa API access token by tampering with the resourcePath return parameter. Because the plugin concatenated the attacker-controlled resourcePath onto the API base domain without a separating slash or validation, a crafted value redirects pretix's server-side status-check request - which carries the account API key - to an attacker-controlled host. No public exploit identified at time of analysis, and the CVSS 4.0 vector carries E:U (exploit unproven).

Technical ContextAI

pretix-oppwa integrates the Oppwa (Open Payment Platform) technology used by providers such as VR Payment and Hobex. Per Oppwa's documented flow, after payment the user is redirected back with a ?resourcePath=/v1/checkouts/{checkoutId}/payment parameter, and the merchant server fetches transaction status from baseUrl + resourcePath. The root cause is CWE-20 (Improper Input Validation): the plugin built the request URL by string-concatenating the untrusted resourcePath onto the base domain with no trailing slash and no allowlist/validation of the resulting URL. This effectively creates a server-side request forgery primitive where the outbound status request - which includes the Oppwa account access token - can be pointed at an arbitrary server. The single affected component per CPE is cpe:2.3:a:pretix:pretix-oppwa:*:*:*:*:*:*:*:* (all versions prior to the fix).

RemediationAI

Vendor-released patch: update pretix and the pretix-oppwa plugin to the 2026.5.3 release, which strictly validates the constructed API URL - see the advisory at https://pretix.eu/about/en/blog/20260701-release-2026-5-3/. Critically, because the flaw can leak the Oppwa access token, after updating you must request a new access token (API key) from your payment provider (VR Payment, Hobex, or other Oppwa provider) and update it in pretix, since any previously used token should be considered potentially compromised. If immediate patching is not possible, compensating controls are limited given the flaw sits in the payment return path; you can restrict outbound network egress from the pretix server so it only reaches the legitimate Oppwa/provider API endpoints (an allowlist egress firewall), preventing the token from being sent to an attacker host - the trade-off is added operational complexity and the risk of breaking legitimate provider callbacks if endpoint IPs change. Disabling the Oppwa payment provider until patched fully removes exposure but stops accepting payments through that provider.