CVE-2026-107852 Details
Description
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.
A vulnerability in Jexactyl's game management panel and billing system, prior to version 4.0.5, allows authenticated clients to manipulate payment amounts and currencies through the Stripe Checkout integration. The issue arises in the POST /api/client/billing/stripe/process endpoint, which processes payments based solely on a 'paid' status without verifying that the amount or currency matches the corresponding order. This flaw enables users to complete payments for significantly less than the actual price, resulting in unauthorized server provisions, renewals, upgrades, or unsuspensions. The vulnerability affects Jexactyl versions through 4.0.1, with the billing module active and a Stripe secret key configured.
Users can update to Jexactyl version 4.0.5, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 9, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-rf56-676w-hj4g | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Jexactyl/Jexactyl/commit/fdee722c560ac13dc2d26271912203a6085dffe3 | [email protected] | Source CodeVendor |
| https://github.com/Jexactyl/Jexactyl/releases/tag/v4.0.5 | [email protected] | Release NotesVendor |
| https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-rf56-676w-hj4g | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Jexactyl | <= 4.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2026 | New CVE Received | [email protected] |