CVE-2026-54608: CWE-345: Insufficient Verification of Data Authenticity in MythicalLTD MythicalDash
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldash_stripe_payments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET /api/stripe/processed accepts that code without constructing a Session, checking ownership, or retrieving the Stripe Checkout Session to require payment_status to be paid and amount_total to match the expected charge. An ordinary authenticated user can request an attacker-selected coins amount, abandon or fail payment, and submit the pending code directly to the unauthenticated processed endpoint. StripeDB::isPending() then permits User::addCreditsAtomic() to grant the unpaid amount and mark the row processed even though Stripe has not confirmed payment. This permits arbitrary free virtual-currency top-ups and direct financial loss through consumption of hosting resources. No fixed version is available as of this review.
AI Analysis
Technical Summary
MythicalDash versions up to 3.5.4-aurora have an insufficient verification of data authenticity vulnerability (CWE-345) in the Stripe payment processing flow. The GET /api/stripe/process endpoint creates a pending payment record before Stripe checkout completion and embeds the payment code in the success redirect. However, the GET /api/stripe/processed endpoint accepts this code without verifying session ownership or confirming payment status and amount via Stripe's API. Consequently, an authenticated user can submit a pending payment code for an attacker-selected amount without completing payment, causing the system to credit virtual currency improperly. This flaw allows arbitrary free credit top-ups and direct financial loss due to unconfirmed payments being accepted as valid.
Potential Impact
Exploitation of this vulnerability enables authenticated users to fraudulently add virtual currency credits without completing payment, resulting in direct financial loss for the service provider through unauthorized resource consumption. The flaw undermines the integrity of the payment verification process, potentially impacting revenue and trust in the payment system.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users and administrators should monitor vendor advisories for updates. Until a fix is released, restricting access to the affected endpoints or implementing additional manual verification may reduce risk, but no vendor-provided mitigation is confirmed.
CVE-2026-54608: CWE-345: Insufficient Verification of Data Authenticity in MythicalLTD MythicalDash
Description
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldash_stripe_payments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET /api/stripe/processed accepts that code without constructing a Session, checking ownership, or retrieving the Stripe Checkout Session to require payment_status to be paid and amount_total to match the expected charge. An ordinary authenticated user can request an attacker-selected coins amount, abandon or fail payment, and submit the pending code directly to the unauthenticated processed endpoint. StripeDB::isPending() then permits User::addCreditsAtomic() to grant the unpaid amount and mark the row processed even though Stripe has not confirmed payment. This permits arbitrary free virtual-currency top-ups and direct financial loss through consumption of hosting resources. No fixed version is available as of this review.
CVSS v4.0
Score 7.1high
Affected software
MythicalLTD
MythicalDash
pkg:github/mythicalltd/MythicalDashRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
MythicalDash versions up to 3.5.4-aurora have an insufficient verification of data authenticity vulnerability (CWE-345) in the Stripe payment processing flow. The GET /api/stripe/process endpoint creates a pending payment record before Stripe checkout completion and embeds the payment code in the success redirect. However, the GET /api/stripe/processed endpoint accepts this code without verifying session ownership or confirming payment status and amount via Stripe's API. Consequently, an authenticated user can submit a pending payment code for an attacker-selected amount without completing payment, causing the system to credit virtual currency improperly. This flaw allows arbitrary free credit top-ups and direct financial loss due to unconfirmed payments being accepted as valid.
Potential Impact
Exploitation of this vulnerability enables authenticated users to fraudulently add virtual currency credits without completing payment, resulting in direct financial loss for the service provider through unauthorized resource consumption. The flaw undermines the integrity of the payment verification process, potentially impacting revenue and trust in the payment system.
Mitigation Recommendations
No official fix or patch is currently available for this vulnerability. Users and administrators should monitor vendor advisories for updates. Until a fix is released, restricting access to the affected endpoints or implementing additional manual verification may reduce risk, but no vendor-provided mitigation is confirmed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T19:45:23.540Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aac65bc55bf5e2cf5fdf62e
Added to database: 09/17/2026, 22:12:12 UTC
Last enriched: 09/17/2026, 22:13:06 UTC
Last updated: 09/18/2026, 03:25:18 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.