Search
Find a vulnerability
Search criteria
2 vulnerabilities by go-pay
CVE-2026-105218 (GCVE-0-2026-105218)
Vulnerability from nvd – Published: 2026-10-04 17:09 – Updated: 2026-10-05 14:55
VLAI
EPSS
VEX
Title
gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client
Summary
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 13:59 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-pay/gopay/issues/540 | issue-tracking |
| https://github.com/go-pay/gopay/commit/f6df04fd4f… | patch |
| https://github.com/go-pay/gopay/blob/v1.5.118/pkg… | technical-description |
| https://github.com/go-pay/gopay | product |
| https://www.vulncheck.com/advisories/gopay-before… | third-party-advisory |
Date Public
2026-06-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105218",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T13:59:07.358923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T14:55:01.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/go-pay/gopay",
"product": "gopay",
"vendor": "go-pay",
"versions": [
{
"lessThan": "1.5.119",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-04T17:09:53.573Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #540",
"tags": [
"issue-tracking"
],
"url": "https://github.com/go-pay/gopay/issues/540"
},
{
"tags": [
"patch"
],
"url": "https://github.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fd"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37"
},
{
"tags": [
"product"
],
"url": "https://github.com/go-pay/gopay"
},
{
"name": "VulnCheck Advisory: gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certificate-verification-in-xhttp-client"
}
],
"title": "gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105218",
"datePublished": "2026-10-04T17:09:53.573Z",
"dateReserved": "2026-10-04T13:04:00.479Z",
"dateUpdated": "2026-10-05T14:55:01.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105218 (GCVE-0-2026-105218)
Vulnerability from cvelistv5 – Published: 2026-10-04 17:09 – Updated: 2026-10-05 14:55
VLAI
EPSS
VEX
Title
gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client
Summary
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-05 13:59 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/go-pay/gopay/issues/540 | issue-tracking |
| https://github.com/go-pay/gopay/commit/f6df04fd4f… | patch |
| https://github.com/go-pay/gopay/blob/v1.5.118/pkg… | technical-description |
| https://github.com/go-pay/gopay | product |
| https://www.vulncheck.com/advisories/gopay-before… | third-party-advisory |
Date Public
2026-06-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105218",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-05T13:59:07.358923Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T14:55:01.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/go-pay/gopay",
"product": "gopay",
"vendor": "go-pay",
"versions": [
{
"lessThan": "1.5.119",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Siyang Wu"
}
],
"datePublic": "2026-06-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-04T17:09:53.573Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #540",
"tags": [
"issue-tracking"
],
"url": "https://github.com/go-pay/gopay/issues/540"
},
{
"tags": [
"patch"
],
"url": "https://github.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fd"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37"
},
{
"tags": [
"product"
],
"url": "https://github.com/go-pay/gopay"
},
{
"name": "VulnCheck Advisory: gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certificate-verification-in-xhttp-client"
}
],
"title": "gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-105218",
"datePublished": "2026-10-04T17:09:53.573Z",
"dateReserved": "2026-10-04T13:04:00.479Z",
"dateUpdated": "2026-10-05T14:55:01.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}