Is CVE-2026-71537 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71537 being exploited in the wild.

How severe is CVE-2026-71537?

Medium severity, with a CVSS score of 6.5, published 18 September 2026.

Is there a fix for CVE-2026-71537?

Yes. paymenter/paymenter (Packagist): upgrade to 1.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71537 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-71537?

Check whether you run paymenter/paymenter (Packagist) or Paymenter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71537: Paymenter credit refund double-spend race condition in service downgrade

CVE-2026-71537 · Severity: medium · CVSS 6.5 · Published 2026-09-18

Paymenter is a billing and service provisioning platform used by hosting providers to manage customer subscriptions and payments. An authentication race condition in the service downgrade logic allows a customer to receive multiple refunds for a single downgrade action, inflating their account credit balance to an arbitrary amount. This credit can then be used to provision additional services or offset legitimate invoices, causing direct financial loss to the platform operator.

Technologies: paymenter/paymenter (Packagist), Paymenter. Vendors: Packagist, Paymenter.

Quick answers

Is CVE-2026-71537 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71537 being exploited in the wild.
How severe is CVE-2026-71537?: Medium severity, with a CVSS score of 6.5, published 18 September 2026.
Which products and versions are affected?: paymenter/paymenter (Packagist) <= 1.5.6, ECOSYSTEM:introduced=0,fixed=1.5.7; Paymenter <UNKNOWN>.
Is there a fix for CVE-2026-71537?: Yes. paymenter/paymenter (Packagist): upgrade to 1.5.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71537 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-71537?: Check whether you run paymenter/paymenter (Packagist) or Paymenter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

paymenter/paymenter (Packagist): upgrade to 1.5.7 or later
```
composer require paymenter/paymenter:^1.5.7
```

Technical details

The vulnerability is a race condition in the service downgrade handler (`app/Livewire/Services/Upgrade.php::doUpgrade()`) that lacks transactional safety or database-level locking. The application checks for pending upgrades using an unisolated query, allowing concurrent requests to simultaneously observe no pending record and all proceed past the eligibility check. Each concurrent request then executes `$credit->increment()` independently, cumulatively inflating the user's refund amount by the number of parallel requests. An authenticated user can send multiple downgrade requests in parallel to trigger N refunds for a single service downgrade. The vulnerability requires the user to be authenticated and the service to be downgradable, but has no other preconditions. A patch would require wrapping the validation and credit update in a database transaction with row-level locking.

Affected products

Paymenter Paymenter <UNKNOWN>

Identifiers

CVE-2026-71537
GHSA-5gmm-hjfj-8ff7

Timeline

2026-09-18: disclosed: Advisory published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.