Threats affecting pkg:github/mythicalltd/MythicalDash

CVE-2026-54608 is a vulnerability in MythicalLTD's MythicalDash (version 3.5.4-aurora and earlier) involving insufficient verification of data authenticity in the Stripe payment processing API. The flaw allows authenticated users to exploit the payment process by submitting a pending payment code without actual payment confirmation, resulting in free virtual currency top-ups. This leads to direct financial loss through unauthorized consumption of hosting resources. No fixed version is currently available.