Pos
Monthly
Missing 3D Secure hash verification in mews/pos (CVE-2026-118377) through 2.0.0 allows unauthenticated remote attackers to forge payment callbacks for GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host transactions, potentially completing orders without payment. The flaw affects applications using those three gateways in those two 3D models; integrity impact is high while confidentiality and availability are unaffected. VulnCheck assigns a this_week priority, an upstream fix is available via PR #305/commit 7c59d42, and no public exploit identified at time of analysis.
Missing 3D Secure hash verification in mews/pos (CVE-2026-118377) through 2.0.0 allows unauthenticated remote attackers to forge payment callbacks for GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host transactions, potentially completing orders without payment. The flaw affects applications using those three gateways in those two 3D models; integrity impact is high while confidentiality and availability are unaffected. VulnCheck assigns a this_week priority, an upstream fix is available via PR #305/commit 7c59d42, and no public exploit identified at time of analysis.