Roncoo-pay: Missing authorization in F2F order query exposes payment records
Summary
The F2F order query endpoint /f2fPay/order/query in roncoo-pay through commit 9428382 returns the full payment record for a supplied trxNo without any authentication or merchant ownership check. An unauthenticated attacker who guesses or obtains a valid transaction number can read payment data of other merchants, including identities, amounts, fees and notify URLs. Exploitation requires guessing snowflake-based identifiers, which the CNA rates as high complexity, and a public write-up exists.
Affected
- roncoo-pay through commit 9428382af21cd5568319eae7429b7e1d0332ff40 (default branch master, no release tag)
- Module: roncoo-pay-web-gateway, endpoint /f2fPay/order/query
Fixed in
Unknown. No fixed version or patched commit has been published.
Workaround
- Block or restrict access to /f2fPay/order/query at the firewall or reverse proxy, allowing only known merchant or payment provider IP ranges.
- Require authentication for the path at the proxy layer.
- No vendor workaround is known.
Exploitation
- Public proof of concept: a public write-up exists; its details were not verified in depth.
- Not known to be exploited in the wild.
- CISA SSVC: exploitation poc, not automatable, partial technical impact.
Our recommendation
- Check whether roncoo-pay is in use in your environment. If not, no action is needed.
- If it is in use and reachable from the internet, restrict the order query endpoint immediately.
- Review web logs for requests to /f2fPay/order/query from unknown sources.
- Monitor the upstream repository for a fix and rebuild from a fixed commit when available.
- Treat payment record disclosure as high impact if the instance is exposed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Vulnerable code (GitHub, F2FPayController.java) github.com
- VulnCheck advisory www.vulncheck.com
- HackMD write-up hackmd.io
- VulDB entry vuldb.com
- Vulners CVE record vulners.com
- roncoo-pay project github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:52.
Original description (NVD)
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' prefix plus a snowflake ID, to obtain the full serialized payment record of any merchant.
NVD references (4)
- https://github.com/roncoo/roncoo-pay/blob/9428382af21cd5568319eae7429b7e1d0332ff40/roncoo-pay-web-gateway/src…
- https://hackmd.io/@hieuPenguinnn/roncoo-pay-f2f-order-query-unauth-record-disclosure
- https://www.vulncheck.com/advisories/roncoo-pay-through-commit-9428382-information-disclosure-via-f2fpay-orde…
- https://hackmd.io/@hieuPenguinnn/roncoo-pay-f2f-order-query-unauth-record-disclosure
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.