mews/pos: Missing hash verification of 3D Pay and 3D Host callbacks
Summary
The PHP payment package mews/pos up to and including version 2.0.0 does not verify the hash of 3D Pay and 3D Host callbacks for the GarantiPos, PayForPos and InterPos gateways. An unauthenticated attacker can send a forged callback with a tampered status, amount or order ID, which may cause an order to be completed without payment. The issue applies only if an application uses this package with these gateways.
Affected
- mewebstudio/pos versions 0 to 2.0.0 (inclusive)
- Gateways: GarantiPos, PayForPos, InterPos (3D Pay and 3D Host flows)
Fixed in
- Fix merged into the master branch (PR #305, commit 7c59d42bc49483c7c54999d757cb67055d9f732a)
- Fixed release version: Unknown.
Workaround
- Update to a release that contains the PR #305 change; until a fixed release is confirmed, use a reviewed master commit or patch locally.
- Check that the setting disable_3d_hash_check is not enabled in your deployment.
- Validate status fields strictly and only complete orders for expected values.
- Do not mark orders as paid based on the callback alone; confirm the payment status with the acquiring bank or a server-side status query before fulfilment.
Exploitation
- Known exploitation: None found.
- Public proof of concept: None found.
- EPSS: 0.18 % (low near-term likelihood).
Our recommendation
- Check whether the package mews/pos (Composer package pos) is used in your shop or by your developers.
- If it is used: treat as high priority, apply the fix or a patched master commit, and check the release notes for a fixed version.
- Confirm payments server-side with the payment provider before releasing goods.
- Monitor orders for paid status without a matching bank settlement.
- If the package is not used, no action is needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE-2026-118377 VulnCheck advisory www.vulncheck.com
- Pull request #305 (fix) github.com
- Commit 7c59d42 (fix on master) github.com
- Issue #306 github.com
- InterPos.php at 50ed2bf github.com
- PayForPos.php at 50ed2bf github.com
- mewebstudio/pos releases github.com
- VulDB CVE-2026-118377 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:48.
Original description (NVD)
mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying.
NVD references (7)
- https://github.com/mewebstudio/pos
- https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/InterPos.php#L13…
- https://github.com/mewebstudio/pos/blob/50ed2bfe4f8980b8b0c47996de571943fa58d7ad/src/Gateway/PayForPos.php#L1…
- https://github.com/mewebstudio/pos/commit/7c59d42bc49483c7c54999d757cb67055d9f732a
- https://github.com/mewebstudio/pos/issues/306
- https://github.com/mewebstudio/pos/pull/305
- https://www.vulncheck.com/advisories/mews-pos-through-2.0.0-missing-hash-verification-in-3d-pay-and-3d-host-c…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.