CVE-2026-111660: waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

Q: Who is exposed to exploitation?

Any deployment of waynboot-mall through 2.0.0 that exposes the /callback/order/unpaid endpoint to an unauthenticated network client is exposed. No attacker account or user interaction is required.

Q: What does an attacker need to cancel an order?

The attacker needs an orderSn for a pending unpaid order. OrderSn values are predictable because they are built from epoch seconds and a sequential counter, allowing attackers to submit candidate values.

Q: What is the practical impact beyond cancelling an order?

An attacker can cancel any member's pending order and manipulate product stock levels through repeated unauthenticated requests to the endpoint.

Q: What can be done if patching is not immediately possible?

Restrict unauthenticated access to /callback/order/unpaid so untrusted clients cannot reach it. This directly prevents the described unauthenticated cancellation requests.

Published Oct 16, 2026

Updated

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.

Affected Software

1 affected component

waynboot-mall<=2.0.0

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Any deployment of waynboot-mall through 2.0.0 that exposes the /callback/order/unpaid endpoint to an unauthenticated network client is exposed. No attacker account or user interaction is required.

What does an attacker need to cancel an order?

The attacker needs an orderSn for a pending unpaid order. OrderSn values are predictable because they are built from epoch seconds and a sequential counter, allowing attackers to submit candidate values.

What is the practical impact beyond cancelling an order?

An attacker can cancel any member's pending order and manipulate product stock levels through repeated unauthenticated requests to the endpoint.

What can be done if patching is not immediately possible?

Restrict unauthenticated access to /callback/order/unpaid so untrusted clients cannot reach it. This directly prevents the described unauthenticated cancellation requests.

CVE-2026-111660: waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid

Affected Software

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to cancel an order?

What is the practical impact beyond cancelling an order?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to cancel an order?

What is the practical impact beyond cancelling an order?

What can be done if patching is not immediately possible?