CVE-2026-85531: Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x
Published Oct 9, 2026
·Updated
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.
This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
Affected Software
1 affected component
Sipay Electronic Money and Payment Services OpenCart Virtual POS Module>=26.8.2<26.9.1
Event History
Oct 9, 2026
CVE Published
via MITRE·12:28 PM
Data Sourced
via MITRE·12:28 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Sipay Electronic Money and Payment Services OpenCart Virtual POS Module versions from 26.8.2 before 26.9.1 are affected.
2
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.
3
What is the potential impact of successful exploitation?
The vulnerability is rated critical with high confidentiality, integrity, and availability impact in the supplied vector. It involves signature spoofing caused by improper cryptographic signature verification.