CVE-2026-33661 Details
Description
Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.
A vulnerability exists in the Yansongda Pay SDK for WeChat payment services, in versions through 3.7.19. The issue arises in the 'verify_wechat_sign()' function, located in 'src/Functions.php', which fails to verify signatures for requests that indicate 'localhost' as the host. This flaw can be exploited by sending a manipulated HTTP request to the WeChat Pay callback endpoint, effectively bypassing the RSA signature verification. As a result, fraudulent WeChat Pay payment notifications can be sent, causing applications to incorrectly mark orders as paid.
Users can update to Yansongda Pay version 3.7.20 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc | CISA-ADP | ExploitVendor Advisory |
| https://github.com/yansongda/pay/commit/26987ebf789f1e7f0a85febb640986ab4289fd7f | [email protected] | Patch |
| https://github.com/yansongda/pay/releases/tag/v3.7.20 | [email protected] | Release Notes |
| https://github.com/yansongda/pay/security/advisories/GHSA-q938-ghwv-8gvc | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| yansongda pay | < 3.7.20 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |