CVE-2026-54608: MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET /api/stripe/processed accepts that code without constructing a Session, checking ownership, or retrieving the Stripe Checkout Session to require paymentstatus to be paid and amounttotal to match the expected charge. An ordinary authenticated user can request an attacker-selected coins amount, abandon or fail payment, and submit the pending code directly to the unauthenticated processed endpoint. StripeDB::isPending() then permits User::addCreditsAtomic() to grant the unpaid amount and mark the row processed even though Stripe has not confirmed payment. This permits arbitrary free virtual-currency top-ups and direct financial loss through consumption of hosting resources. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be treated as vulnerable?
MythicalDash 3.5.4-aurora and earlier are affected where the Stripe payment flow exposes the described process and processed endpoints. No fixed version is available as of the review.
What access does an attacker need?
An attacker needs an ordinary authenticated user account to request a selected coin amount and obtain a pending payment code. The subsequent processed endpoint accepts that code without authentication, ownership validation, or Stripe Checkout Session verification.
Does the attacker need to complete a Stripe payment?
No. The attacker can abandon or fail the payment and submit the pending code directly, causing the pending payment record to be processed and credits to be added without Stripe confirming that payment was made.
What is the operational impact of a successful exploit?
The attacker can add arbitrary unpaid virtual currency to their account. Those credits can be used to consume hosting resources, creating direct financial loss.