CVE-2026-107852 Jexactyl: Stripe checkout confirmation accepts mismatched-currency/amount payments as full payment (payment forgery)
Authenticated users can forge payments by submitting mismatched Stripe sessions, allowing them to acquire server resources for less than the required price.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-107852?
CVE-2026-107852 is a high-severity vulnerability in Jexactyl, published on 9 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. On an instance where the billing module is enabled and a Stripe secret key is configured, an authenticated client can therefore complete a lower-value or mismatched-currency payment and cause the order to be processed, provisioning, renewing, upgrading, or unsuspending the purchased server for less than the required price. This issue is fixed in version 4.0.5.
Weakness: CWE-345
Which versions are affected by CVE-2026-107852?
How do I fix CVE-2026-107852?
No fix has been published for CVE-2026-107852 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107852 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-107852 exists.
Sources
Also known as GHSA-rf56-676w-hj4g.