CVE-2026-118377 in pos
Summary
by MITRE • 10/28/2026
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified in mews/pos versions through 2.0.0 represents a critical failure in the verification of data authenticity within payment processing integrations. This flaw specifically affects handlers for GarantiPos, PayForPos, and InterPos when utilizing both 3D Secure (3D Pay) and Hosted Payment Page (3D Host) methods. The core technical deficiency lies in the omission of a critical integrity check function known as check3DHash(). In secure payment architectures, this hash verification is essential to ensure that the data returned by external banking or payment gateway callbacks has not been altered during transit and originates from a trusted source. By skipping this validation step, the application fails to authenticate the payload received from third-party services, leaving the system vulnerable to manipulation by unauthenticated attackers who can intercept and modify these communication streams.
From an operational perspective, this vulnerability allows malicious actors to forge payment results without possessing valid credentials or initiating legitimate transactions. Attackers can exploit this weakness by submitting tampered callback data directly to the application's endpoint. By manipulating specific fields such as status, amount, or order ID within the HTTP request body or query parameters, adversaries can trick the system into believing that a transaction has been successfully completed and paid for when it was not. This capability effectively bypasses the financial gatekeeping mechanism of the e-commerce platform, enabling unauthorized completion of orders where goods or services are delivered without corresponding payment being received by the merchant.
The impact of this vulnerability extends beyond immediate financial loss to include significant reputational damage and potential legal liabilities associated with fraud. Because the attack requires no authentication, it can be executed remotely over the network, making it highly scalable for automated exploitation tools. The ability to forge order completion statuses disrupts inventory management systems, leading to stock discrepancies and fulfillment errors that further strain operational resources. Furthermore, if sensitive customer data is processed during these fraudulent transactions, there may be additional compliance implications regarding data protection regulations such as GDPR or PCI DSS standards, although the primary risk remains financial fraud through transaction forgery.
This vulnerability aligns with CWE-345 Insufficient Verification of Data Authenticity and falls under MITRE ATT&CK technique T1608 Supply Chain Compromise if exploited via compromised payment gateways, though more directly it maps to T1199 Reliable Creation of Fake Resources or general injection-based manipulation depending on the specific vector. To mitigate this risk, developers must immediately update mews/pos to a version where the check3DHash() function is correctly invoked for all supported payment handlers including GarantiPos, PayForPos, and InterPos. It is imperative that every callback response from external payment providers undergoes rigorous signature verification before any state changes are applied to orders or inventory systems. Additionally implementing strict input validation on status fields and ensuring that only expected values trigger order completion logic can provide defense-in-depth against such tampering attempts until the underlying library issue is resolved.