CVE-2026-57536
Description
Our payment integration with Mollie did not properly validate payment
status responses. An attacker could use a successful payment status
response from one payment and supply it to the system for a different
payment, gaining access to multiple valid tickets with only one payment.
Summary dbcve.org
The Mollie payment integration fails to validate that payment status responses are tied to the specific payment session or order. An attacker can intercept or reuse a successful payment response from one transaction and replay it against a different order/ticket, obtaining multiple valid tickets while only paying once.
Mitigation
Implement cryptographic binding between payment status responses and the specific order/ticket ID being processed, validating that the payment reference in the response matches the original payment request.