CVE-2026-101275: Insufficient validation of payment status in pretix-adyen
Published Nov 10, 2026
·Updated
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
Affected Software
1 affected component
pypi/pretix-adyen
Event History
Nov 10, 2026
CVE Published
via MITRE·12:00 PM
Data Sourced
via MITRE·12:00 PM
Description
Data Sourced
via NVD·12:17 PM
DescriptionSeverity
Frequently Asked Questions
1
Which installations are affected?
Installations using the pretix payment integration with Adyen are affected by the insufficient validation of payment status responses.
2
What does an attacker need to exploit this issue?
The attacker needs a successful payment status response from one payment and must be able to supply that response for a different payment.