Description
Our payment integration with GiroCheckout did not properly validate
payment status responses. An attacker could use a successful payment
status response from one payment and supply it to the system for a
different payment, gaining access to multiple valid tickets with only
one payment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pretix | pretix-girosolution | < 1.0.1 | 1.0.1 |
References
- https://pretix.eu/about/en/blog/20260728-release-2026-6-1/ vendor-advisory