Payment Status Response Validation Flaw in Adyen Integration by Pretix
CVE-2026-101275

6.3MEDIUM

Key Information:

Vendor

Pretix

Status
Pretix-adyen
Vendor
CVE Published:
10 November 2026

What is CVE-2026-101275?

The Pretix payment integration with Adyen is susceptible to a significant flaw where it fails to adequately validate payment status responses. This deficiency allows attackers to exploit the system by submitting a valid payment status response from one transaction for a different payment, potentially granting them unauthorized access to multiple valid tickets with only a single payment. Proper validation mechanisms are critical to ensure that only legitimate transactions result in access to resources.

Affected Version(s)

pretix-adyen 0 < 1.5.4

References

https://pretix.eu/about/en/blog/20261110-adyen/
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Digant Prajapati
.