Executive brief
The pretix-oppwa plugin, used for processing payments through providers like VR Payment and Hobex, contains a security flaw in how it handles payment redirects. An attacker can manipulate a specific web link to trick the system into sending its private payment provider API key to a server controlled by the attacker. If successful, this would give the attacker access to sensitive financial data and transaction records within the payment provider's system.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the pretix-oppwa plugin due to improper input validation and insecure string concatenation. The plugin processes a 'resourcePath' query parameter from a redirect URL and appends it to a 'baseUrl' without a trailing slash or validation. An attacker can craft a 'resourcePath' that causes the system to make an outbound request to an attacker-controlled domain instead of the intended API. Because these requests include the Oppwa account access token (API key) in the headers, the credential is leaked to the attacker. This allows unauthorized access to the payment provider's API. The issue is fixed in version 1.4.4 by implementing strict URL validation.
Affected products
- pretix pretix-oppwa < 1.4.4
Timeline
- 2026-07-01: disclosed: Discovered internally by the vendor
- 2026-07-01: patched: Fixed in version 1.4.4
- 2026-07-01: advisory