Sipay OpenCart Virtual POS Module: Signature verification bypass
Summary
The Sipay Virtual POS module for OpenCart does not properly verify cryptographic signatures on payment data. An unauthenticated remote attacker can forge signatures, which may allow orders to be accepted without a valid payment. The CVSS score is 9.8 (critical). Third-party reports describe forged payment callbacks as the attack path; the vendor has not confirmed this.
Affected
- OpenCart Virtual POS Module (Sipay) from 26.8.2 before 26.9.1
- Earlier versions: Unknown.
- Supported OpenCart core versions (3.x or 4.x): Unknown.
Fixed in
- Version 26.9.1 (according to the Turkish CERT notice TR-26-1287 and the CVE record)
Workaround
- No vendor-confirmed workaround. Upgrading to 26.9.1 is the primary fix.
- Third-party suggestion, not vendor-confirmed: restrict access to the payment callback endpoints to Sipay's gateway IP addresses, but only after confirming these addresses with Sipay.
Exploitation
- Exploited in the wild: No evidence found.
- Public proof of concept: None known.
- KEV listing: None.
- EPSS (30-day): about 0.2%.
- CISA SSVC: Automatable yes, technical impact total.
Our recommendation
- Identify all online shops that use the Sipay OpenCart module and record their versions.
- Upgrade the module to 26.9.1 or later.
- Reconcile recent orders with Sipay settlement statements and review payment callback logs for anomalies.
- Ask Sipay for its own security advisory and confirm the supported OpenCart core versions.
- Check other Sipay plugins as well, since the related CVE-2026-86405 affects the PrestaShop module.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Turkish CERT notice TR-26-1286 siberguvenlik.gov.tr
- GitHub Advisory GHSA-9f78-prj9-gr67 github.com
- Vulners CVE-2026-85531 vulners.com
- Pulse CVE-2026-85531 pulse.kalir.io
- Strix CVE-2026-85531 www.strix.ai
- ThreatAft social post infosec.exchange
- The Hacker Wire CVE-2026-85531 www.thehackerwire.com
- FintekWins Sipay OpenCart advisory (Turkish) www.fintekwins.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:06.
Original description (NVD)
Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.