CVE-2026-118377
mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
| CWE | CWE-345 |
| Vendor | mewebstudio |
| Product | pos |
| Published | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for mewebstudio pos
Be the first to know when new high vulnerabilities affecting mewebstudio pos are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
mewebstudio / pos
0 ≤ 2.0.0
References
github.com: https://github.com/mewebstudio/pos/pull/305 github.com: https://github.com/mewebstudio/pos/commit/7c59d42bc49483c7c54999d757cb67055d9f732a github.com: https://github.com/mewebstudio/pos/issues/306 github.com: https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/PayForPos.php#L135-L150 github.com: https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/InterPos.php#L134-L149 github.com: https://github.com/mewebstudio/pos vulncheck.com: https://www.vulncheck.com/advisories/mews-pos-through-2.0.0-missing-hash-verification-in-3d-pay-and-3d-host-callbacks
Credits
Ali Kostak Ali Kostak