Cpe:2.3:a:mews:pos:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amewspos/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 06:26:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMews pos: Insufficient verification of payment callback authenticity (CVE-2026-118377)https://feed.craftedsignal.io/briefs/2026-10-mews-pos-vulnerability/Wed, 28 Oct 2026 06:26:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mews-pos-vulnerability/The Mews pos package through version 2.0.0 fails to verify 3D secure hashes in payment handlers, enabling unauthenticated remote attackers to forge payment callbacks and bypass payment requirements.CVE-2026-118377 describes an insufficient verification of data authenticity vulnerability in the Mews pos package (up to version 2.0.0). The flaw resides in the GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host handlers, which fail to invoke the check3DHash() function. This omission allows unauthenticated attackers to send crafted HTTP callbacks to the application, containing tampered status, amount, or order ID information, effectively tricking the system into marking orders as paid.

Impact

Successful exploitation allows an attacker to complete orders without submitting valid payment, leading to financial loss and potential inventory manipulation.

Recommendation

  • Inventory systems using the Mews pos package and verify if version 2.0.0 or earlier is in use.
  • Update to a patched version once provided by the vendor.
  • In the absence of an immediate patch, monitor web server access logs for anomalous callback requests directed at payment handler endpoints that do not originate from known, legitimate payment gateway IP addresses.
]]>highadvisory