CVE-2026-13222
Description
Our payment integration with Oppwa-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment status response from one payment and supply it to the
system for a different payment, gaining access to multiple valid
tickets with only one payment.
Summary dbcve.org
The Oppwa payment integration lacks proper validation to ensure payment status responses are tied to the specific transaction being processed. An attacker can capture a successful payment response from one transaction and replay it to validate different payments, allowing multiple tickets to be obtained with only a single payment.
Mitigation
Implement cryptographic binding between payment responses and specific payment transactions, using transaction identifiers and validating response integrity to prevent replay attacks.