by Kastro
Paper/Archive/CVE-2026-105218

CVE-2026-105218

go-pay gopay — gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

EPSS 0.2%CVSS 9.1
critical.is priorityof 100
28
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 5.5.055 × 201.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and transaction data, and modify payment, refund and order query responses.

Affected

ProductAffectedFixed inSource
gopay< 1.5.1191.5.119CNA

Scores by source

VulnCheck (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
VulnCheck (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/go-pay/gopay/issues/540patchgithub.com/go-pay/gopay/commit/f6df04fd4f64a2ad2c303ba063b6502bfdd259fdwriteupgithub.com/go-pay/gopay/blob/v1.5.118/pkg/xhttp/client.go#L15-L37refgithub.com/go-pay/gopaywriteupvulncheck.com/advisories/gopay-before-1.5.119-disabled-tls-certificate-verification-in-xhttp-client