Authentication Bypass in ERP System by Affected Vendor

CVE-2026-107102

What is CVE-2026-107102?

This vulnerability in the ERP system arises from inadequate validation of payment callback parameters combined with insufficient authentication controls in the API endpoint. An attacker with no authentication credentials can exploit this weakness by manipulating parameters, potentially causing the ERP application to create an authenticated session for any user without proper payment verification. If successfully executed, this could enable attackers to bypass standard authentication mechanisms, granting them unauthorized access to the accounts of legitimate users within the affected system.

References