{"id":"CVE-2026-85531","published":"2026-10-09T13:17:10.957","lastModified":"2026-10-12T23:17:45.300","description":"Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation.\n\nThis issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1286","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Sipay OpenCart Virtual POS Module has a critical cryptographic signature verification flaw that allows attackers to spoof digital signatures and gain full control over payment processing operations. This vulnerability enables unauthorized transaction processing and financial data manipulation.","exploitability":"Exploitation is relatively straightforward requiring only network access to the affected module, with no authentication required for signature validation bypass.","blast_radius":"The vulnerability could impact all OpenCart installations using the Sipay Virtual POS module between versions 26.8.2 and 26.9.1, potentially allowing attackers to process fraudulent transactions and access sensitive payment data across multiple merchant systems.","remediation":"Upgrade to version 26.9.1 or later to remediate this cryptographic signature verification vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["payment","signature","crypto"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:43:20.371Z"}}