Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

yansongda/pay

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 8.6PackagistPublished

    WeChat Pay callback signature verification bypassed when Host header is localhost

    CVE-2026-33661 · GHSA-q938-ghwv-8gvc

    Affected
    • Packagist yansongda/pay <= 3.7.19
    Fixed in
    3.7.20· Vendor fix available
    Issue
    The verifywechatsign() function in src/Functions.php unconditionally skips all signature verification when the PSR-7 request reports localhost as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a Host: localhost header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Vulnerable Code src/Functions.php lines 243-246: In PSR-7 implementations (Nyholm, Guzzle PSR-7, etc.), $request-getUri()-getHost() reads the Host HTTP header, which is fully attacker-controlled. Proof of Concept verifywechatsign() returns immediately without verifying the signature. The application marks the order as paid. Impact - Payment fraud: Attacker receives goods/services without actual payment by forging WeChat Pay callbacks - No authentication required: Pure network attack, zero privileges needed -…

    Recommended action: Upgrade to 3.7.20 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →