Executive brief
CediPay is a payment processing service used to handle financial transactions. A vulnerability in its transaction API allows attackers to bypass input validation, potentially leading to unauthorized transactions, theft of financial data, and payment system compromise. This poses direct risks of financial loss and reputational damage to affected organizations and their customers.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in CediPay's transaction API that allows attackers to bypass input validation controls. The flaw is network-accessible via the transaction API with no authentication required, making it remotely exploitable. Successful exploitation could enable unauthorized transactions, exposure of sensitive financial data, and compromise of payment integrity. The issue is patched in version 1.2.3 and later; all prior versions remain vulnerable. Temporary mitigations include restricting API access to trusted networks and enforcing additional input validation at the application layer, though these do not fully eliminate the risk.
Affected products
- CediPay cedipay-core prior to 1.2.3
Timeline
- 2026-02-12: disclosed: Vulnerability published as GHSA-wvr6-395c-5pxr
- 2026-02-12: patched: Fixed in version 1.2.3