CVE-2026-16037
Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API (v9x) WHMCS Module
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3.
| CWE | CWE-208 |
| Vendor | paytr payment and electronic money institution inc. |
| Product | paytr virtual pos iframe api (v9x) whmcs module |
| Published | Sep 8, 2026 |
| Last Updated | Sep 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for paytr payment and electronic money institution inc. paytr virtual pos iframe api (v9x) whmcs module
Be the first to know when new high vulnerabilities affecting paytr payment and electronic money institution inc. paytr virtual pos iframe api (v9x) whmcs module are published โ delivered to Slack, Telegram or Discord.
Get Free Alerts โ
Free ยท No credit card ยท 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
PayTR Payment and Electronic Money Institution Inc. / PayTR Virtual Pos iFrame API (v9x) WHMCS Module
v9.0.0 < v9.0.3
References
Credits
Efe KIRBAล