EUVD-2026-39414
GHSA-x48c-p6xp-x2xg
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N because exploitation is performed remotely via callback replay; AC:H because a prior legitimate payment is a hard prerequisite; PR:N since any public user can make a payment; no confidentiality or availability impact, only limited integrity loss.
Primary rating from Vendor (rami.io).
CVSS VectorVendor: rami.io
Lifecycle Timeline
2DescriptionCVE.org
Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
AnalysisAI
Payment response replay vulnerability in the pretix-oppwa integration allows a remote attacker to reuse a legitimate Oppwa payment confirmation from one transaction to authorize separate, unpaid orders - effectively obtaining multiple valid event tickets with a single payment. All known versions of the pretix-oppwa plugin (cpe:2.3:a:pretix:pretix-oppwa:*) are affected. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the business logic bypass enables direct financial fraud for event organizers. A vendor patch was released in conjunction with Pretix version 2026-5.2.
Technical ContextAI
Pretix is an open-source event ticketing platform; pretix-oppwa is its dedicated integration plugin for the Oppwa payment gateway, which underpins several European payment providers. The flaw maps to CWE-841 (Improper Enforcement of Behavioral Workflow), a business logic class where the application fails to cryptographically or contextually bind a payment status response to the specific transaction, order reference, or amount it was issued for. When Oppwa calls back with a success status, the pretix-oppwa plugin accepts any structurally valid response without verifying it corresponds to the pending order, enabling response reuse across unrelated transactions. The CPE cpe:2.3:a:pretix:pretix-oppwa:*:*:*:*:*:*:*:* confirms all released versions carry this defect.
RemediationAI
The primary fix is to upgrade the pretix-oppwa plugin to the version released alongside Pretix 2026-5.2, as documented at https://pretix.eu/about/en/blog/20260625-release-2026-5-2/. The exact patched plugin version number is not explicitly stated in currently available data - verify the specific package version from the vendor advisory before deploying. Until the patch can be applied, the most effective compensating control is to disable the Oppwa-based payment method entirely in the Pretix organizer settings; this eliminates the attack surface at the cost of preventing all legitimate Oppwa payments for the duration of the mitigation. No network-layer control (firewall rules, WAF signatures) is effective against this flaw because the attack relies on structurally valid HTTP callback requests indistinguishable from legitimate payment confirmations.
pretix before 2024.1.1 mishandles file validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
Server-side URL manipulation in the pretix-oppwa payment plugin (fixed in pretix 2026.5.3) lets a remote attacker exfilt
Stored cross-site scripting in Pretix's PDF ticket and badge layout editor allows one backend user to inject JavaScript
pretix before 2023.7.2 allows Pillow to parse EPS files. Rated high severity (CVSS 7.8), this vulnerability is no authen
Privilege escalation to full account takeover in pretix (open-source event ticketing) and its payment integration plugin
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. Rated high severity (CVSS
Venueless instances allow authenticated users with 'update world' permissions to exfiltrate chat messages from direct me
Cross-world user deletion in venueless allows authenticated API users with 'manage users' permission in one world to del
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tag
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Information disclosure in Pretix email template processing allows authenticated backend users to extract sensitive syste
Payment status replay in pretix-mollie allows unauthenticated attackers to obtain multiple valid event tickets by reusin
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today