Executive brief
A vulnerability in the Computop payment plugin for the pretix ticketing system allows users to bypass payment requirements. By reusing a valid payment confirmation from one transaction for a different order, an attacker could obtain multiple tickets while only paying for one. This could lead to financial loss for event organizers and unauthorized access to events.
Technical details
The vulnerability is classified as an improper enforcement of behavioral workflow (CWE-841) within the pretix-computop payment integration. The root cause is a failure to uniquely bind a payment status response from the Computop gateway to a specific transaction. An attacker can intercept or obtain a successful payment status response and replay it to the system for a different order. This allows for the generation of valid tickets without corresponding payments. The issue is fixed in version 1.3.2 of the pretix-computop plugin.
Affected products
- pretix pretix-computop < 1.3.2
Timeline
- 2026-06-25: disclosed
- 2026-06-25: patched: Fixed in version 1.3.2