CVE-2026-118377: mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
Affected Software
Event History
Frequently Asked Questions
Which payment integrations are affected?
The affected handlers are GarantiPos, PayForPos, and InterPos implementations using 3D Pay or 3D Host callbacks. The issue affects mews/pos through version 2.0.0.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to be able to submit a callback to an affected handler with tampered payment status, amount, or order ID fields.
What is the likely impact of a successful exploit?
An attacker can forge a payment result and cause an order to be completed without a legitimate payment. The provided severity vector identifies integrity impact, with no stated confidentiality or availability impact.
How can I determine whether my deployment is exposed?
Check whether your application uses mews/pos version 2.0.0 or earlier and processes 3D Pay or 3D Host callbacks through GarantiPos, PayForPos, or InterPos. Exposure exists where those handlers do not validate callback data with check3DHash().