Executive brief
The PayRange Android app, used for making mobile payments at vending machines and laundromats, fails to properly verify security certificates. This allows an attacker on the same network to intercept the connection and steal sensitive information, such as login credentials or payment data, that the user sends through the app. In some cases, attackers could also issue unauthorized commands to payment-enabled hardware.
Technical details
The PayRange Android app (version 7.0.7 and below) improperly validates SSL certificates within application WebViews (CWE-295). The application bypasses the standard Android trust chain by accepting any certificate—including self-signed ones—that matches specific string patterns in the Common Name (e.g., 'payrange.com', 'stripe.com') or specific Issuer Common Names (e.g., 'R10', 'R3'). An unauthenticated on-path attacker can exploit this to perform a Man-in-the-Middle (MitM) attack, intercepting encrypted traffic between the app and servers like Stripe. This allows for the harvesting of credentials, reading of user data, or injection of malicious content into the WebView.
Affected products
- PayRange PayRange 7.0.7 and below
Timeline
- 2026-05-18: other: Vendor notified by CERT/CC
- 2026-07-09: disclosed: Public disclosure by CERT/CC and NVD