{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/pos--2.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:mews:pos:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118377"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["pos (\u003c= 2.0.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Mews"],"content_html":"\u003cp\u003eCVE-2026-118377 describes an insufficient verification of data authenticity vulnerability in the Mews pos package (up to version 2.0.0). The flaw resides in the GarantiPos, PayForPos, and InterPos 3D Pay and 3D Host handlers, which fail to invoke the \u003ccode\u003echeck3DHash()\u003c/code\u003e function. This omission allows unauthenticated attackers to send crafted HTTP callbacks to the application, containing tampered status, amount, or order ID information, effectively tricking the system into marking orders as paid.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to complete orders without submitting valid payment, leading to financial loss and potential inventory manipulation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory systems using the Mews pos package and verify if version 2.0.0 or earlier is in use.\u003c/li\u003e\n\u003cli\u003eUpdate to a patched version once provided by the vendor.\u003c/li\u003e\n\u003cli\u003eIn the absence of an immediate patch, monitor web server access logs for anomalous callback requests directed at payment handler endpoints that do not originate from known, legitimate payment gateway IP addresses.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T06:26:41Z","date_published":"2026-10-28T06:26:41Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mews-pos-vulnerability/","summary":"The Mews pos package through version 2.0.0 fails to verify 3D secure hashes in payment handlers, enabling unauthenticated remote attackers to forge payment callbacks and bypass payment requirements.","title":"Mews pos: Insufficient verification of payment callback authenticity (CVE-2026-118377)","url":"https://feed.craftedsignal.io/briefs/2026-10-mews-pos-vulnerability/"}],"language":"en","title":"CraftedSignal Threat Feed - Pos (\u003c= 2.0.0)","version":"https://jsonfeed.org/version/1.1"}