Threats tagged 'ghsa-8f6w-7m2h-mfwg'

A critical vulnerability (CVE-2026-105218) exists in gopay versions before 1.5.119 where TLS certificate verification is disabled in the defaultClient() function. This flaw allows man-in-the-middle attackers to impersonate payment provider APIs by presenting any certificate, enabling them to read sensitive merchant credentials, signatures, and transaction data, as well as modify payment, refund, and order query responses.