CVE-2026-54608 Details
Description
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldash_stripe_payments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET /api/stripe/processed accepts that code without constructing a Session, checking ownership, or retrieving the Stripe Checkout Session to require payment_status to be paid and amount_total to match the expected charge. An ordinary authenticated user can request an attacker-selected coins amount, abandon or fail payment, and submit the pending code directly to the unauthenticated processed endpoint. StripeDB::isPending() then permits User::addCreditsAtomic() to grant the unpaid amount and mark the row processed even though Stripe has not confirmed payment. This permits arbitrary free virtual-currency top-ups and direct financial loss through consumption of hosting resources. No fixed version is available as of this review.
A vulnerability exists in MythicalDash versions through 3.5.4-aurora, specifically within the Stripe payment processing API. The issue arises in the endpoint '/api/stripe/processed', which is intended to handle successful payment confirmations. This endpoint grants account credits based solely on a payment code provided in the query string, without any authentication or verification of the payment's actual status with Stripe. As a result, an authenticated user can exploit this by initiating a payment, abandoning it, and then manually submitting the payment code to receive free credits. This flaw not only allows for unauthorized virtual currency top-ups but also incurs direct financial losses by depleting hosting resources.
The vulnerability has been patched in a private fork, which is not yet merged into the main repository. The patch requires an authenticated session for the '/api/stripe/processed' endpoint, verifies that the user owns the payment code, and confirms with Stripe that the payment was completed before granting credits. This fix should be applied to the main branch.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MythicalLTD/MythicalDash/security/advisories/GHSA-qmh4-5v7g-42jq | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/MythicalLTD/MythicalDash/commit/188d4c4ed80b8d364b0c4605a9e38ceaab746e39 | [email protected] | Source CodeVendor |
| https://github.com/MythicalLTD/MythicalDash/security/advisories/GHSA-qmh4-5v7g-42jq | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MythicalDash | <= 3.5.4-aurora (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |