mews/pos versions up to 2.0.0 have a vulnerability where unauthenticated attackers can forge payment results by submitting unverified callbacks. Specific payment handlers skip critical verification checks, allowing attackers to manipulate order completion without actual payment.