CVE-2026-105218: gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gopayto a version that resolves this vulnerability.Fixed in 1.5.119
Event History
Frequently Asked Questions
Who is exposed to this issue?
Merchants using gopay versions before 1.5.119 are exposed when their applications make payment-provider API requests through the affected default xhttp client. An attacker able to position themselves between the application and the provider API can impersonate that API.
What does an attacker need to exploit it?
The attacker needs man-in-the-middle network access to intercept the application's connection to a payment provider API. No application privileges or user interaction are required, but exploitation has high attack complexity.
Are payment operations the only affected requests?
No. A successful attacker can read merchant credentials, signatures, and transaction data, and can modify payment, refund, and order-query responses.
How can I determine whether my deployment is affected?
Check whether the application depends on gopay earlier than 1.5.119 and uses the default client implemented in pkg/xhttp/client.go. The affected behavior is TLS certificate verification being disabled in defaultClient().
What is the available remediation?
Upgrade gopay to version 1.5.119 or later, which is outside the stated affected version range.