Skip to content
OpenAdvisories

Vendor

go-pay

1 known vulnerabilities.

Products

gopay 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.4
    CVE-2026-105218

    gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client

    gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and…

    go-pay gopay