CVE-2026-13223
Description
Our payment integration with Computop-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment status response from one payment and supply it to the
system for a different payment, gaining access to multiple valid
tickets with only one payment.
Summary dbcve.org
The Computop payment integration lacks proper validation linking payment status responses to specific transactions. An attacker can capture a successful payment response from one order and replay it to validate other payments, obtaining multiple valid tickets without completing actual payments.
Mitigation
Implement cryptographic or transactional validation to ensure payment status responses are uniquely bound to the specific payment request, such as validating transaction IDs, order IDs, and using signed responses.