CVE-2026-86405: CWE-347 Improper verification of cryptographic signature in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module

This vulnerability (CVE-2026-86405) in the PrestaShop Virtual POS Module by Sipay Electronic Money and Payment Services Inc. is caused by improper verification of cryptographic signatures (CWE-347). This flaw allows attackers to spoof signatures by bypassing validation checks, potentially leading to unauthorized actions or data manipulation within the payment module. The affected versions are >=26.8.1 and <26.9.1. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to spoof cryptographic signatures, potentially leading to unauthorized transactions, data tampering, or disruption of payment services. The impact is critical as it affects core security controls of the payment module, compromising confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There are no patch links provided in the available data. Users should monitor official vendor communications for updates and apply any official fixes once available. Until then, consider restricting access to the affected module and monitoring for suspicious activity related to signature validation.