CVE-2026-33661 WeChat Pay callback signature verification bypassed when Host header is localhost
Attackers can bypass signature verification by spoofing the Host header, allowing them to forge payment success notifications and mark orders as paid without actual payment.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33661?
CVE-2026-33661 is a high-severity vulnerability in yansongda pay, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pay is an open-source payment SDK extension package for various Chinese payment services. Prior to version 3.7.20, the `verify_wechat_sign()` function in `src/Functions.php` unconditionally skips all signature verification when the PSR-7 request reports `localhost` as the host. An attacker can exploit this by sending a crafted HTTP request to the WeChat Pay callback endpoint with a `Host: localhost` header, bypassing the RSA signature check entirely. This allows forging fake WeChat Pay payment success notifications, potentially causing applications to mark orders as paid without actual payment. Version 3.7.20 fixes the issue.
Weakness: CWE-290
Which versions are affected by CVE-2026-33661?
2 open source packages ship an affected version, including yansongda/pay. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
yansongda/pay Packagist | All versions | 3.7.20 |
yansongda/pay Packagist | All versions | 3.7.20 |
Products include Yansongda Pay.
How do I fix CVE-2026-33661?
Upgrade yansongda/pay to 3.7.20 or later.
Is CVE-2026-33661 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33661 exists.
Sources
Also known as GHSA-q938-ghwv-8gvc.