Payment Bypass Vulnerability in Paicoding Application by Itwanger

CVE-2026-129144

What is CVE-2026-129144?

Paicoding version 1.0.3 is susceptible to a payment bypass vulnerability that allows authenticated users to access paid content without proper authorization. This flaw is due to the use of weak algorithmic patterns in the payment confirmation process. By exploiting this vulnerability, attackers can initiate a payment transaction, subsequently guess potential confirmation codes by enumerating around 2000 possible values. If they successfully match a generated code with the system's verification callback, they can unfairly claim access to paid articles, raising significant security concerns for the platform.

References