Threats affecting pkg:github/yansongda/pay

CVE-2026-33661 is an authentication bypass vulnerability in the yansongda pay SDK prior to version 3.7.20. The vulnerability arises because the verify_wechat_sign() function skips signature verification if the HTTP request's Host header is set to 'localhost'. This allows an attacker to forge WeChat Pay payment success notifications by sending a crafted request with a 'Host: localhost' header, causing applications to incorrectly mark orders as paid. The issue is fixed in version 3.7.20.