CVE-2026-33661

HighPublic PoC

Published: 26 March 2026

Published

26 March 2026

Modified

01 April 2026

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

EPSS Score 0.0002 4.5th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-33661 is a high-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Yansongda Pay. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

preventrecover

Requires timely remediation of the specific flaw in the Pay SDK's verify_wechat_sign() function by upgrading to version 3.7.20, eliminating the localhost Host header bypass.

SI-10 Information Input Validation good match

prevent

Mandates validation of external HTTP inputs like the Host header to prevent spoofing that triggers unconditional skipping of RSA signature verification.

SI-7 Software, Firmware, and Information Integrity good match

prevent

Ensures software employs cryptographic integrity checks such as RSA signatures on WeChat Pay notifications without bypassing them based on untrusted Host headers.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability allows network-accessible attackers to exploit a public-facing web application's callback endpoint by spoofing the Host header to bypass authentication, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit…

this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.

Deeper analysisAI

CVE-2026-33661 affects the open-source Pay SDK, an extension package for integrating various Chinese payment services, including WeChat Pay. In versions prior to 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` bypasses all RSA signature verification if the PSR-7 HTTP request specifies `localhost` as the host header. This flaw, classified under CWE-290 (Authentication Bypass by Spoofing), carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N), highlighting its high severity due to network accessibility and scope change.

Any unauthenticated remote attacker can exploit this vulnerability by crafting an HTTP request to an application's WeChat Pay callback endpoint and setting the `Host` header to `localhost`. This tricks the SDK into skipping signature checks entirely, enabling the forgery of fake payment success notifications. Consequently, the target application may incorrectly process orders as paid, leading to potential financial losses without any actual payment from the customer.

The GitHub security advisory (GHSA-q938-ghwv-8gvc), release notes for v3.7.20, and the fixing commit (26987ebf789f1e7f0a85febb640986ab4289fd7f) confirm that upgrading to version 3.7.20 resolves the issue by addressing the unconditional localhost bypass in signature verification. Security practitioners should prioritize patching affected Pay SDK integrations and review callback endpoint configurations to prevent header spoofing.