Threat database

CVE-2026-103671 is a vulnerability in the EC-CUBE AmazonPay V2 Plugin (4.0/4.1 series) that allows external control of a web parameter assumed to be immutable. This flaw can cause users to be redirected to arbitrary websites during the ordering process, potentially leading to unauthorized access to user account information. The vulnerability has a medium severity rating with a CVSS score of 4.7.

EC-CUBE provided by EC-CUBE CO.,LTD.contains a multi-factor authentication (MFA) bypass vulnerability. An attacker who has obtained a valid administrator ID and password may be able to bypass two-factor authentication and gain unauthorized access to the administrative page.