Executive brief
PayRange is a mobile payment application used to pay for vending machines and laundry services. A security flaw in version 7.0.7 allows an attacker to inject malicious code into the app's internal web browser. If exploited, an attacker could steal user credentials, intercept payment data, or even issue unauthorized commands to physical PayRange hardware with the permissions of a machine operator.
Technical details
A JavaScript injection vulnerability (CVE-2026-13461) exists in the PayRange Android app version 7.0.7. When combined with a secondary SSL bypass vulnerability (CVE-2026-13462) that accepts invalid or self-signed certificates, an on-path attacker can intercept traffic and inject malicious JavaScript into the application's WebView. This injection allows the attacker to escape the WebView sandbox, enabling them to harvest credentials, read user data, or issue commands to PayRange hardware. The vulnerability is particularly severe for machine operators, as injected code can execute commands with their full permissions. As of the advisory date, the vendor has not responded to coordination efforts, and users are advised to monitor for updates.
Affected products
- PayRange PayRange 7.0.7
Timeline
- 2026-05-18: other: Vendor notified
- 2026-07-09: disclosed: Public disclosure by CERT/CC