Pay with Vipps and MobilePay for WooCommerce before 6.4.1 Webhook Signature Forgery

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• wordpress.org/plugins/woo-vipps Yama
• vulncheck.com/…r-woocommerce-before-webhook-signature-forgery Üçüncü taraf
• plugins.trac.wordpress.org/browser/woo-vipps/trunk/recurring/changelog.txt Diğer
• plugins.trac.wordpress.org/…runk/recurring/includes/wc-vipps-recurring.php Diğer

Kayıt geçmişi

1. 4 Kas 2026 16:01Yayımlandı

İlgili açıklar

• 8,8 CVE-2026-122267MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presi…
• 2,3 CVE-2026-111062A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
• 9,1 CVE-2026-116790FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY
• 7,4 CVE-2026-93998Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer
• 9,1 CVE-2026-117691Keycloak SAML HTTP-Redirect bağlamında imza doğrulama atlatma açığı
• 9,1 CVE-2026-102894GPUStack SAML geri çağırma uç noktasında kimlik doğrulama atlatma ve hesap ele geçirme