CVE-2026-107852 in Jexactyl
Summary
by MITRE • 10/10/2026
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
Jexactyl serves as a customizable game management panel and billing system designed to facilitate the administration of gaming servers and associated financial transactions. The vulnerability identified within versions prior to 4.0.5 resides specifically in the POST /api/client/billing/stripe/process endpoint, which is responsible for handling payment confirmations from Stripe Checkout Sessions. This component plays a critical role in the automated provisioning and management of server resources based on successful payments. When an authenticated client submits a request with a payment_status indicating that the transaction has been paid, the system proceeds to process the order without performing adequate validation against the expected financial parameters defined by the administrator or inherent to the specific service being purchased.
The core technical flaw is a lack of integrity verification regarding monetary values and currency codes during the post-payment processing phase. Specifically, the application fails to compare the amount_total field from the Stripe Checkout Session with the price associated with the referenced order in its database. Furthermore, it does not validate that the currency specified in the payment matches the configured billing currency for the instance or the specific product being purchased. This omission allows an attacker who possesses valid authentication credentials to manipulate the financial outcome of a transaction. By supplying a Stripe Checkout Session where the paid amount is lower than the required price or involves a mismatched currency, the client can bypass the intended pricing controls and force the system to recognize the payment as sufficient for fulfillment.
The operational impact of this vulnerability is significant from both a financial security and service integrity perspective. An authenticated attacker can exploit this logic error to acquire server resources such as provisioning new instances, renewing existing subscriptions, upgrading plans, or unsuspending suspended accounts at a cost significantly below the intended price or entirely free if they manipulate the currency conversion rates effectively. This represents a direct loss of revenue for the hosting provider and undermines the economic model of the service. Additionally, it creates an environment where malicious actors could potentially abuse resources by repeatedly exploiting this flaw to maintain access without paying fair market value, leading to resource exhaustion and unfair competition among legitimate users who pay full price.
This vulnerability is classified under CWE-20 Improper Input Validation as the system fails to adequately validate input data against expected constraints before processing critical business logic. It also aligns with ATT&CK technique T1534.001, specifically Internal Remote Services Exploitation, where an attacker leverages internal application functions that are accessible via authenticated sessions to perform unauthorized actions. The exploitation requires the attacker to have a valid account and knowledge of the Stripe API structure, but once achieved, it allows for direct financial manipulation through standard web interface interactions rather than complex network-level attacks.
To mitigate this vulnerability, organizations running Jexactyl must immediately upgrade to version 4.0.5 or later, where the developers have implemented proper validation checks. These fixes ensure that the amount_total and currency from the Stripe webhook are strictly compared against the order details and configured billing settings before any provisioning actions are triggered. In environments where upgrading is not immediately feasible, administrators should implement strict server-side verification of payment amounts using a secondary service or internal logic to cross-reference Stripe data with local database records. Additionally, enabling robust logging for all billing-related API calls can aid in detecting anomalous patterns indicative of exploitation attempts, such as frequent requests involving mismatched currencies or significantly underpaid orders. Regular security audits and penetration testing focused on financial transaction flows are recommended to identify similar logical flaws in other parts of the application infrastructure.