Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-105218: gopay before 1.5.119 can be tricked by fake certificates
CVE-2026-105218 · published 14 days ago
Summary
The GoPay library versions earlier than 1.5.119 do not check the authenticity of the security certificates when connecting to payment services. This lets an attacker pretend to be the payment provider, see merchant credentials and transaction details, and change payment responses. Update to version 1.5.119 or later, or configure the library to verify certificates properly.
What to do
- Update go-pay gopay to version 1.5.119 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| go-pay | gopay | < 1.5.119 |
Original advisory text
gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.
References
- https://www.vulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certifica...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-1052... Vendor Advisory
- https://github.com/go-pay/gopay
- https://github.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37
- https://github.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fd
- https://github.com/go-pay/gopay/issues/540
- https://nvd.nist.gov/vuln/detail/CVE-2026-105218 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.1
Critical
Type
CWE-295Improper Certificate Validation
Timeline
Published4 Oct 2026
Updated14 Oct 2026
First seen4 Oct 2026
Track software like this
Free during beta