Is CVE-2026-13603 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13603 being exploited in the wild.

How severe is CVE-2026-13603?

Informational severity, with a CVSS score of 9, published 1 July 2026.

Is there a fix for CVE-2026-13603?

A patch was published on 2026-07-01: Fixed in version 1.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13603 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-13603?

Check whether you run Pretix-Oppwa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13603: pretix-oppwa SSRF and API key leak in payment redirect handling

CVE-2026-13603 · Severity: info · CVSS 9 · Published 2026-07-01

The pretix-oppwa plugin, used for processing payments through providers like VR Payment and Hobex, contains a security flaw in how it handles payment redirects. An attacker can manipulate a specific web link to trick the system into sending its private payment provider API key to a server controlled by the attacker. If successful, this would give the attacker access to sensitive financial data and transaction records within the payment provider's system.

Vendors: Pretix.

Quick answers

Is CVE-2026-13603 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13603 being exploited in the wild.
How severe is CVE-2026-13603?: Informational severity, with a CVSS score of 9, published 1 July 2026.
Which products and versions are affected?: Pretix-Oppwa < 1.4.4.
Is there a fix for CVE-2026-13603?: A patch was published on 2026-07-01: Fixed in version 1.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13603 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-13603?: Check whether you run Pretix-Oppwa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the pretix-oppwa plugin due to improper input validation and insecure string concatenation. The plugin processes a 'resourcePath' query parameter from a redirect URL and appends it to a 'baseUrl' without a trailing slash or validation. An attacker can craft a 'resourcePath' that causes the system to make an outbound request to an attacker-controlled domain instead of the intended API. Because these requests include the Oppwa account access token (API key) in the headers, the credential is leaked to the attacker. This allows unauthorized access to the payment provider's API. The issue is fixed in version 1.4.4 by implementing strict URL validation.

Affected products

pretix pretix-oppwa < 1.4.4

Timeline

2026-07-01: disclosed: Discovered internally by the vendor
2026-07-01: patched: Fixed in version 1.4.4
2026-07-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.