PT-2026-28169 · Unknown · Wechat Pay

Yansongda

·

Publicado

2026-03-25

·

Atualizado

2026-03-26

·

CVE-2026-33661

CVSS v3.1

8.6

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Pay versions prior to 3.7.20
Description The verify wechat sign() function in src/Functions.php does not properly validate signatures when the Host header in a PSR-7 request is set to localhost. This allows an attacker to bypass the RSA signature check by sending a crafted HTTP request to the WeChat Pay callback endpoint with a Host: localhost header. This can lead to the forging of fake WeChat Pay payment success notifications, potentially resulting in applications incorrectly marking orders as paid without actual payment. The vulnerable code is located in src/Functions.php lines 243-246. The function verify wechat sign() is vulnerable. The API endpoint affected is the WeChat Pay callback endpoint. The Host header is a vulnerable parameter.
Recommendations Versions prior to 3.7.20 should be updated to version 3.7.20 or later.

Exploit

Correção

Authentication Bypass by Spoofing

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾

Enumeração de Fraquezas

Identificadores relacionados

CVE-2026-33661
GHSA-Q938-GHWV-8GVC

Produtos afetados

Wechat Pay