EUVD-2026-46088
GHSA-rv89-wch8-c574
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Requires authenticated low-privileged session (PR:L) to reach the email update endpoint; impact is integrity-only with no confidentiality or availability consequence.
Primary rating from Vendor (https://github.com/Paymenter/Paymenter).
CVSS VectorVendor: https://github.com/Paymenter/Paymenter
Lifecycle Timeline
2DescriptionCVE.org
Summary
The email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified status after switching to an unverified or unowned email address.
Technical Details
When a user updated their email address, the system did not reset or revalidate the associated email verification status. As a result, the verification column remained set to “true” even after the email address was changed.
This allowed an attacker to:
- Verify an account using a legitimate email address
- Change the account email to an arbitrary or unowned address
- Retain the verified status without re-confirmation of the new email
No verification challenge or confirmation was required for the newly assigned email address.
Impact
This vulnerability allows a user to associate a verified account with an email address they do not control, this may result in:
- Misrepresentation of email ownership
- Bypass of verification-based trust assumptions
- Potential abuse of features gated behind verified status
No direct unauthorized access to other users accounts or data is possible through this issue alone.
AnalysisAI
Email verification bypass in Paymenter allows authenticated users to retain verified account status after changing their email to an address they do not own or control. The email update function fails to reset the verification column, meaning a user who initially verifies with a legitimate address can subsequently substitute any arbitrary email and keep the verified flag intact. No public exploit has been identified at time of analysis; the vendor-confirmed fix is available in version 1.5.0.
Technical ContextAI
Paymenter is a PHP/Composer-based billing and client management panel (pkg:composer/paymenter/paymenter). The flaw is rooted in CWE-287 (Improper Authentication) - specifically, the application's email update routine modifies the stored email address but does not reset the associated verification state, such as an email_verified_at timestamp or equivalent boolean column. In correctly implemented systems, any email address change should atomically invalidate the prior verification record and trigger a fresh confirmation flow to the new address. Paymenter omits this reset, allowing the database verification flag to persist across address changes. The CPE data confirms the affected component as the core Paymenter composer package, with all versions below 1.5.0 implicated.
RemediationAI
Upgrade Paymenter to version 1.5.0 or later; this is the vendor-confirmed fix as documented in the GitHub Security Advisory GHSA-rv89-wch8-c574 at https://github.com/Paymenter/Paymenter/security/advisories/GHSA-rv89-wch8-c574. For operators who cannot upgrade immediately, a targeted compensating control is to disable the user-facing email change functionality at the application or web server layer - for example, by restricting access to the email update endpoint - until the patch can be applied. This trades off user self-service convenience for the removal of the vulnerable code path. Administrators should also audit accounts where email addresses were changed after initial verification to identify any that may have already exploited this issue; forcing re-verification on those accounts would remediate any persisted false states.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today