Gopay (< 1.5.119)

The gopay library versions prior to 1.5.119 contain a flaw in defaultClient() that disables TLS certificate verification, enabling man-in-the-middle attacks to intercept sensitive payment data.