CVE-2026-111660: Missing Authentication for Critical Function in wayn111 waynboot-mall
Description
waynboot-mall versions up to 2.0.0 have a missing authentication vulnerability in the /callback/order/unpaid endpoint. This flaw allows unauthenticated attackers to cancel any member's pending unpaid order by submitting predictable orderSn values. The vulnerability can be exploited to manipulate product stock levels by auto-cancelling unpaid orders.
CVSS v4.0
Score 6.9medium
Affected software
wayn111
waynboot-mall
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111660 describes a missing authentication vulnerability in waynboot-mall through version 2.0.0. The /callback/order/unpaid endpoint does not require authentication, enabling unauthenticated attackers to cancel pending unpaid orders of any member. Attackers can generate predictable orderSn values based on epoch seconds and a sequential counter to automate cancellation of unpaid orders, which can affect product stock management.
Potential Impact
Unauthenticated attackers can cancel any user's unpaid orders, potentially disrupting order processing and manipulating product stock levels. This could lead to inventory inaccuracies and denial of service to legitimate customers attempting to complete purchases.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /callback/order/unpaid endpoint to authenticated and authorized users only, or implement additional authentication controls to prevent unauthorized order cancellations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:16.233Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad264132cdf04f65619958b
Added to database: 10/16/2026, 17:51:15 UTC
Last enriched: 10/16/2026, 18:33:58 UTC
Last updated: 10/16/2026, 19:03:25 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.