Gopay
Monthly
Applications built on the gopay Go payment SDK before v1.5.119 accept any TLS certificate on outbound calls to payment provider APIs, because defaultClient() in pkg/xhttp/client.go hard-codes tls.Config{InsecureSkipVerify:true}. An unauthenticated attacker who already occupies an on-path/man-in-the-middle position between the application and the provider can therefore impersonate the payment API, read merchant credentials, signatures and transaction data, and tamper with payment, refund and order-query responses. The vendor has released a fix in v1.5.119 and there is no indication of confirmed active exploitation or publicly available exploit code at time of analysis; the headline CVSS 4.0 base score of 9.1 (Critical) reflects high confidentiality and integrity impact but is tempered by AC:H and AT:P, meaning exploitation requires prior network positioning rather than trivial remote access.
Applications built on the gopay Go payment SDK before v1.5.119 accept any TLS certificate on outbound calls to payment provider APIs, because defaultClient() in pkg/xhttp/client.go hard-codes tls.Config{InsecureSkipVerify:true}. An unauthenticated attacker who already occupies an on-path/man-in-the-middle position between the application and the provider can therefore impersonate the payment API, read merchant credentials, signatures and transaction data, and tamper with payment, refund and order-query responses. The vendor has released a fix in v1.5.119 and there is no indication of confirmed active exploitation or publicly available exploit code at time of analysis; the headline CVSS 4.0 base score of 9.1 (Critical) reflects high confidentiality and integrity impact but is tempered by AC:H and AT:P, meaning exploitation requires prior network positioning rather than trivial remote access.