Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-101275 EUVD-2026-120896GHSA-rqhp-qxw5-gr5x

Insufficient validation of payment status in pretix-adyen

Published Nov 10, 2026 · Assigned by pretix

Description

Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.

Affected products

VendorProductAffectedFixed
pretix pretix-adyen < 1.5.4 1.5.4

References