Mews pos: Insufficient verification of payment callback authenticity (CVE-2026-118377)
The Mews pos package through version 2.0.0 fails to verify 3D secure hashes in payment handlers, enabling unauthenticated remote attackers to forge payment callbacks and bypass payment requirements.
CVE search metadata
CVE search record: CVE-2026-118377. Severity: high. CVSS: 7.5. KEV: no. Product: pos (<= 2.0.0). Brief: Mews pos: Insufficient verification of payment callback authenticity (CVE-2026-118377). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mews-pos-vulnerability/
Triage facts
Revision 1- Applicability
- pos (<= 2.0.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 06:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A5Roughly even chance
CVE-2026-118377 describes an insufficient verification of data authenticity vulnerability in the Mews pos package (up to version 2.0.0). The flaw resides in the GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host handlers, which fail to invoke the check3DHash() function. This omission allows unauthenticated attackers to send crafted HTTP callbacks to the application, containing tampered status, amount, or order ID information, effectively tricking the system into marking orders as paid.
Impact
Successful exploitation allows an attacker to complete orders without submitting valid payment, leading to financial loss and potential inventory manipulation.
Recommendation
- Inventory systems using the Mews pos package and verify if version 2.0.0 or earlier is in use.
- Update to a patched version once provided by the vendor.
- In the absence of an immediate patch, monitor web server access logs for anomalous callback requests directed at payment handler endpoints that do not originate from known, legitimate payment gateway IP addresses.
Threat Hunt
Identify anomalous callback traffic to payment handler endpoints
Data: Web server access logs (HTTP POST requests to payment callback URLs)
Mitigations
Identify and isolate applications using vulnerable versions of mews/pos
CVE-2026-118377