Skip to content
OpenAdvisories
High · 7.5 CVE-2026-16037 EUVD-2026-72853GHSA-v26j-p538-j93h

Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

Published Sep 8, 2026 · Updated Oct 1, 2026 · Assigned by TR-CERT

Vendor: PayTR Payment and Electronic Money Institution Product: PayTR Virtual Pos iFrame API WHMCS Module

Description

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module allows Black Box Reverse Engineering.

This issue affects PayTR Virtual Pos iFrame API WHMCS Module: from v9.0.0 before v9.0.3.

Affected products

VendorProductAffectedFixed
PayTR Payment and Electronic Money Institution PayTR Virtual Pos iFrame API WHMCS Module v9.0.0 – < v9.0.3 v9.0.3

References