The yansongda pay SDK, an open-source payment extension for Chinese payment services, contains a critical authentication bypass vulnerability (CWE-290) in versions before 3.7.20. Specifically, the verify_wechat_sign() function in src/Functions.php disables RSA signature verification when the PSR-7 request's Host header equals 'localhost'. An attacker exploiting this flaw can send a malicious HTTP request to the WeChat Pay callback endpoint with a spoofed Host header, bypassing signature checks and forging payment success notifications. This can lead to applications accepting fake payments. The vulnerability has a CVSS 3.1 score of 8.6 (high severity) and was fixed in version 3.7.20.

Exploitation of this vulnerability allows an unauthenticated attacker to bypass RSA signature verification for WeChat Pay callbacks by spoofing the Host header as 'localhost'. This results in the ability to forge fake payment success notifications, potentially causing affected applications to mark orders as paid without actual payment. The impact is high on integrity, but does not affect confidentiality or availability.

Upgrade yansongda pay to version 3.7.20 or later, where the verify_wechat_sign() function properly enforces signature verification regardless of the Host header. No other mitigations are indicated by the vendor advisory. Patch status is confirmed fixed in version 3.7.20.