Description
Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pretix | pretix-adyen | < 1.5.4 | 1.5.4 |
References
- https://pretix.eu/about/en/blog/20261110-adyen/ vendor-advisory