CVE-2026-119558
OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points
CVSS Score
3.1
EPSS Score
0.0%
EPSS Percentile
0th
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, then submit zero points via reward.save so the confirm handler advances the order to Free Checkout status without payment.
| CWE | CWE-841 |
| Vendor | opencart |
| Product | opencart |
| Published | Oct 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for opencart opencart
Be the first to know when new low vulnerabilities affecting opencart opencart are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
OpenCart / OpenCart
0 ≤ 4.1.0.4
References
github.com: https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/checkout/reward.php#L89-L94 github.com: https://github.com/opencart/opencart/blob/4.1.0.4/upload/extension/opencart/catalog/controller/payment/free_checkout.php#L47-L55 abraxaslabs.tech: https://abraxaslabs.tech/research/opencart-reward-free-checkout github.com: https://github.com/opencart/opencart vulncheck.com: https://www.vulncheck.com/advisories/opencart-through-4.1.0.4-payment-bypass-via-free-checkout-reward-points
Credits
Abraxas Labs