EUVD-2026-49752
GHSA-f83j-v8r3-vfhv
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because a prior real payment is required as prerequisite; PR:N since no application account privileges are needed; I:L for fraudulent ticket issuance; no confidentiality or availability impact.
Primary rating from Vendor (655498c3-6ec5-4f0b-aea6-853b334d05a6).
CVSS VectorVendor: 655498c3-6ec5-4f0b-aea6-853b334d05a6
Lifecycle Timeline
2DescriptionCVE.org
Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
AnalysisAI
Payment response replay fraud in pretix-girosolution allows an unauthenticated network attacker to reuse a legitimate GiroCheckout payment confirmation from one order to fulfill multiple additional orders without payment, effectively obtaining valid event tickets at no cost beyond a single real transaction. The affected package pretix-girosolution versions prior to 1.0.1 fails to bind payment status responses to specific order identifiers, enabling this cross-order token reuse. No public exploit has been identified at time of analysis, and CISA KEV does not list active exploitation; however, the financial fraud potential makes this a priority for event operators relying on GiroCheckout.
Technical ContextAI
pretix-girosolution is a payment plugin for the pretix open-source event ticketing platform, integrating with GiroCheckout (a German online payment gateway operated by GiroSolution AG). The root cause is CWE-841: Improper Enforcement of Behavioral Workflow - the integration does not validate that a payment status response received from GiroCheckout is cryptographically or semantically bound to the specific order/transaction it was originally issued for. In a correctly implemented payment callback flow, each payment confirmation should include an order-specific nonce, transaction ID, or HMAC binding it to one and only one order. The pretix-girosolution plugin's webhook or callback handler apparently accepts any structurally valid GiroCheckout success response, regardless of whether its embedded transaction identifiers match the pending order. Affected versions: pretix-girosolution 0 through <1.0.1 per EUVD-2026-49752 CPE data.
RemediationAI
Upgrade pretix-girosolution to version 1.0.1 or later, which contains the vendor-released patch per the advisory at https://pretix.eu/about/en/blog/20260728-release-2026-6-1/. If immediate upgrade is not possible, event operators can disable GiroCheckout as an active payment method within pretix settings until the patch is applied - this prevents new orders from reaching the vulnerable callback handler, with the trade-off of removing GiroCheckout as a payment option. Operators should also audit recent orders where payment was collected via GiroCheckout for anomalies such as a single GiroCheckout transaction ID appearing across multiple fulfilled orders, which would indicate prior exploitation. No additional workaround eliminates the flaw without disabling the payment method.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today