Vendor
The Mews pos package through version 2.0.0 fails to verify 3D secure hashes in payment handlers, enabling unauthenticated remote attackers to forge payment callbacks and bypass payment requirements.