CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up
Attackers can bypass Stripe payment verification to grant themselves arbitrary free credits, causing financial loss for hosting providers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-54608?
CVE-2026-54608 is a high-severity vulnerability in MythicalLTD MythicalDash, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldash_stripe_payments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET /api/stripe/processed accepts that code without constructing a Session, checking ownership, or retrieving the Stripe Checkout Session to require payment_status to be paid and amount_total to match the expected charge. An ordinary authenticated user can request an attacker-selected coins amount, abandon or fail payment, and submit the pending code directly to the unauthenticated processed endpoint. StripeDB::isPending() then permits User::addCreditsAtomic() to grant the unpaid amount and mark the row processed even though Stripe has not confirmed payment. This permits arbitrary free virtual-currency top-ups and direct financial loss through consumption of hosting resources. No fixed version is available as of this review.
Which versions are affected by CVE-2026-54608?
How do I fix CVE-2026-54608?
No fix has been published for CVE-2026-54608 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-54608 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54608 exists.
Sources
Also known as GHSA-qmh4-5v7g-42jq.