CVE-2026-26063 CediPay Affected by Improper Input Validation in Payment Processing
Attackers can bypass input validation in the transaction API of the CediPay crypto-to-fiat application, potentially altering transaction data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-26063?
CVE-2026-26063 is a high-severity vulnerability in xpertforextradeinc CediPay, published on 19 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attackers to bypass input validation in the transaction API. The issue has been fixed in version 1.2.3. If upgrading is not immediately possible, restrict API access to trusted networks or IP ranges; enforce strict input validation at the application layer; and/or monitor transaction logs for anomalies or suspicious activity. These mitigations reduce exposure but do not fully eliminate the vulnerability.
Weakness: CWE-20
Which versions are affected by CVE-2026-26063?
2 open source packages ship an affected version, including cedipay-core.
| Package | Affected | Fixed in |
|---|---|---|
cedipay-core npm | All versions | 1.2.3 |
cedipay-core npm | All versions | 1.2.3 |
How do I fix CVE-2026-26063?
Upgrade cedipay-core to 1.2.3 or later.
Is CVE-2026-26063 being exploited?
There is no known exploitation of CVE-2026-26063 in the wild and no public exploit code.
Sources
Also known as GHSA-wvr6-395c-5pxr.