CVE-2026-33661
Published: 26 March 2026
Summary
CVE-2026-33661 is a high-severity Authentication Bypass by Spoofing (CWE-290) vulnerability in Yansongda Pay. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-33661 affects the open-source Pay SDK, an extension package for integrating various Chinese payment services, including WeChat Pay. In versions prior to 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` bypasses all RSA signature verification if the PSR-7 HTTP request specifies `localhost` as the host header. This flaw, classified under CWE-290 (Authentication Bypass by Spoofing), carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N), highlighting its high severity due to network accessibility and scope change.
Any unauthenticated remote attacker can exploit this vulnerability by crafting an HTTP request to an application's WeChat Pay callback endpoint and setting the `Host` header to `localhost`. This tricks the SDK into skipping signature checks entirely, enabling the forgery of fake payment success notifications. Consequently, the target application may incorrectly process orders as paid, leading to potential financial losses without any actual payment from the customer.
The GitHub security advisory (GHSA-q938-ghwv-8gvc), release notes for v3.7.20, and the fixing commit (26987ebf789f1e7f0a85febb640986ab4289fd7f) confirm that upgrading to version 3.7.20 resolves the issue by addressing the unconditional localhost bypass in signature verification. Security practitioners should prioritize patching affected Pay SDK integrations and review callback endpoint configurations to prevent header spoofing.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16428
Vulnerability details
Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit…
more
this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows network-accessible attackers to exploit a public-facing web application's callback endpoint by spoofing the Host header to bypass authentication, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of the specific flaw in the Pay SDK's verify_wechat_sign() function by upgrading to version 3.7.20, eliminating the localhost Host header bypass.
Mandates validation of external HTTP inputs like the Host header to prevent spoofing that triggers unconditional skipping of RSA signature verification.
Ensures software employs cryptographic integrity checks such as RSA signatures on WeChat Pay notifications without bypassing them based on untrusted Host headers.