Insufficient Data Authentication in mews/pos Product Leads to Payment Forgery Risk
CVE-2026-118377

8.7HIGH

Key Information:

Vendor

Mewebstudio

Status
Pos
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118377?

The mews/pos product version up to 2.0.0 is susceptible to a data authenticity vulnerability, allowing unauthenticated attackers to forge payment results through unauthorized submission of unverified callbacks. The integration of GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host handlers does not adequately validate data integrity, particularly skipping the check3DHash() verification process. This enables attackers to tamper with critical fields such as status, amount, or order ID, enabling completion of payment transactions without proper authorization.

Affected Version(s)

pos 0 <= 2.0.0

References

https://github.com/mewebstudio/pos/pull/305
patchissue-tracking
https://github.com/mewebstudio/pos/commit/7c59d42bc49483c...
patch
https://github.com/mewebstudio/pos/issues/306
issue-tracking

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ali Kostak
Ali Kostak
.