Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118377mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

High 7.5

In plain English

A high-severity insufficient verification of data authenticity in pos from mewebstudio. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 92.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.

Affected products (as reported)

Vendor	Product	Versions
mewebstudio	pos	0 – through 2.0.0

Weakness: CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/mewebstudio/pos/pull/305 patch, issue-tracking
https://github.com/mewebstudio/pos/commit/7c59d42bc49483c7c54999d757cb67055d9f732a patch
https://github.com/mewebstudio/pos/issues/306 issue-tracking
https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/PayForPos.php#L135-L150 technical-description
https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/InterPos.php#L134-L149 technical-description
https://github.com/mewebstudio/pos product
VulnCheck Advisory: mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks third-party-advisory