CVE-2026-105218

critical · 9.1

gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.

9.1

CVSS

0.2%

EPSS (exploit prob.)

6th

EPSS percentile

2026-10-04

Published

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-295

References

https://github.com/go-pay/gopay
https://github.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37
https://github.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fd
https://github.com/go-pay/gopay/issues/540
https://www.vulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certificate-verification-in-xhttp-client

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-105218